AT Section 9501

Reporting on an Entity’s Internal Control Over Financial Reporting: Attest Engagements Interpretations of Section 501

1. Pre-Award Surveys

.01

Question—As part of the procss of applying for a government grant or contract, an entity may be required to submit a written pre-award survey by management about the effectiveness (suitability) of the design of an entity’s internal control or a portion thereof for the government’s purposes, together with a practitioner’s report thereon. May a practitioner issue such a report based on the consideration of internal control in an audit of the entity’s financial statements?

.02

Interpretation—No. The purpose of the consideration of an entity’s internal control in a financial statement audit is to obtain an understanding sufficient to plan the audit and to determine the nature, timing and extent of audit tests to be performed and not to provide assurance on internal control. The consideration made in a financial statement audit does not provide the practitioner with a sufficient basis to issue a report expressing any assurance about the effectiveness of the design of internal control or any portion thereof.

.03

Question—How may a practitioner report on the design effectiveness of an entity’s internal control or a portion thereof?

.04

Interpretation—In order to issue such a report, the practitioner should perform an examination of or apply agreed-upon procedures to management’s written assertion about the effectiveness (suitability) of the design of an entity’s internal control as described in section 501, Reporting on an Entity’s Internal Control Over Financial Reporting, paragraphs .23 through .26 and .70 through .76. When the engagement involves the application of agreed-upon procedures to a written assertion about the design effectiveness of the entity’s internal control over compliance with specified requirements, the practitioner should also follow the provisions of section 601, Compliance Attestation, paragraphs .09 and .11 through .29, and section 201, Agreed-Upon Procedures Engagements.

.05

Question—What are a practitioner’s responsibilities when requested to sign a form prescribed by a government agency in connection with a pre-award survey?

.06

Interpretation—The practitioner should refuse to sign such a prescribed form unless he or she has performed an attest engagement, as discussed in paragraph .04. If the practitioner has conducted such an attest engagement, he or she should consider whether the wording of the prescribed form conforms to the requirements of professional standards. For example, the prescribed form may contain a description of the practitioner’s responsibilities or the practitioner’s conclusions that is not in conformity with those standards. Some prescribed forms can be made acceptable by inserting additional or deleting existing wording; others can be made acceptable only by complete revision. When a prescribed form contains a statement or wording not in conformity with professional standards, the practitioner should either reword the form to conform to those standards or attach a separate report conforming with such standards in place of the prescribed form.

.07

Question—An entity may also be required to submit a written pre-award survey about its ability to establish suitably designed internal control, together with a practitioner’s report thereon. May a practitioner issue such a report based on the consideration of existing internal control in an audit of an entity’s financial statements or the performance of an attest engagement?

.08

Interpretation—No. Neither the consideration of internal control in an audit of an entity’s financial statements nor the performance of an attest engagement provides the practitioner with a basis for issuing a report on the ability of an entity to establish suitably designed internal control. There are no suitable criteria for evaluating the entity's ability to establish suitably designed internal control. The requesting agency may be willing to accept a report of the practitioner on a consulting service. The practitioner should consider including in the consulting service report—

1. A statement that the practitioner is unable to perform an attest engagement on the entity’s ability to establish suitably designed internal control because there are no suitable criteria for evaluating the entity's ability to do so;
2. A description of the nature and scope of the practitioner’s services; and
3. The practitioner’s findings.

The practitioner may refer to the guidance in CS section 100, Consulting Services: Definitions and Standards.

[Issue Date: February 1997; Revised: January 2001.]