Peer Review Board Open Session Meeting Materials Oct. 2018 · 1 AICPA Peer Review Board Open...

Peer Review Board Open Session Materials

October 19, 2018 Conference Call

Peer Review Program

1

1

AICPA Peer Review Board

Open Session Agenda Friday October 19, 2018

Teleconference Date: Friday October 19, 2018 Time: 1:00PM – 4:00PM Eastern Time Meeting room: Teleconference Conference call number: External: 855 880 1246 (US Toll Free) AICPA Staff: 408 638 0968 Meeting ID: 919 402 2199 1.1 Welcome Attendees and Roll Call of Board** – Mr. Kindem/Mr. Parry 1.2 Approval of a Revised Effective Date for Annual Peer Review Information Form* - Mr. Pope 1.3 Discussion of Potential Revisions to Guidance Related to Broker-Dealers** - Ms. Bare 1.4 Task Force Updates*

• Oversight Task Force Report – Mr. Bluhm o A – RAB Observations Summary*

• Education and Communication Task Force Report – Ms. Kerber • Standards Task Force Report – Mr. Pope

o B – Update on Clarified Peer Review Standards* 1.5 Operations Director’s Report** – Ms. Thoresen 1.6 Report from State CPA Society CEOs** – Ms. Birmingham 1.7 Update on National Peer Review Committee** – Mr. Fawley 1.8 Update on QCM Project** - Ms. Rowley 1.9 Other Business** - Mr. Parry 1.10 For Informational Purposes:

A. AICPA PRB Annual Report on Oversight* B. Compliance Update - Firm Noncooperation* C. Report on Firms Whose Enrollment was Dropped or Terminated*

1.11 Future Open Session Meetings** A. January 30, 2019 Open session – Scottsdale, AZ B. May 3, 2019 Open session – Durham, NC C. August 8, 2019 Open session – Washington, DC

* Included on SharePoint ** Verbal Discussion

2

1

Agenda Item 1.2

Revised Effective Date for Annual Peer Review Information Form

Why is this on the Agenda? The Standards Task Force would like to propose revising the effective date of the Annual Peer Review Information Form (PRI) to May 1, 2020. The proposal does not include a transition period. The revised date will allow the AICPA to use limited technology funds to enhance processes currently in PRIMA rather than building new functionality. The extra time will also allow staff more time to adequately solidify requirements, build, and test the new functionality prior to being released to all peer review firms in 2020. Background In August 2017, the Peer Review Board (PRB) approved the collection of peer review information on an annual basis using an Annual Peer Review Information Form (PRI). The Annual PRI will include the collection of data on the current PRI (engagement related data for purposes of determining the type of peer review and review team expertise needed) with additional information on the ranges of engagements performed and quality control related questions. The information collected would be analyzed by PRIMA to more timely reference firms to resources. For example, if a firm takes on employee benefit plan audits for the first time, they will be directed to resources that may assist them in performing quality audits. This would happen at the time they submit their Annual PRI rather than waiting for the firm’s peer reviewer to suggest those resources at the time of their next peer review. In addition to references to free practice guides and resources available, the annual requests for information will:

• more frequently remind firms of Peer Review Program changes • promote a focus on the firm’s quality control annually and not just in the peer review year • increase efficiency for firms when providing information due to the increased familiarity

with PRIMA • allow the AICPA and administering entities (AEs) to more timely identify potential trends

that may need addressed through guidance or training. The Annual PRI was approved effective May 1, 2018 and included a transition period to help alleviate undue confusion. The transition period would allow firms to file annual submissions in intervening years but would not require submission until the year following its next peer review following May 1, 2018. In January 2018, the PRB approved delaying the effective date to May 1, 2019 and removing the transition period. Due to the issues encountered with the PRIMA go-live and the high cost associated with a transition period, the changes were approved to allow the AICPA to focus on making the system more user-friendly. Feedback Received The enhancements made to PRIMA in 2018 have been well received by users. In 2019, we are planning to work directly with firms that do not use PRIMA often to make sure that we make the system even more user-friendly. These changes are expected to be implemented in 2019 and could impact the requirements for the Annual PRI.

3

2

PRIMA Impact The Annual PRI will be included in PRIMA. Initial requirements have already been developed through a PRB task force but may need revised pending the 2019 enhancements. AE Impact AEs will likely receive questions from firms and reviewers about the new questions and why the information must be submitted annually. Communications Plan We have issued several communications about the change to annual submission and its benefits. A full communication plan is yet to be developed but it will include early notification to firms that this information is required annually. Manual Production Cycle (estimated) None. The noncooperation interpretation already addresses being dropped from the Peer Review Program for failure to submit this information annually. The form itself is not part of the manual. Effective Date Firms receive a request to complete the PRI about 7 months prior to its peer review due date. That same timing will be used annually starting May 1, 2020. Board Consideration Approve a revised effective date for PRIs generated on or after May 1, 2020 for the Annual PRI.

4

1

Agenda Item 1.4

Standing Task Force Updates

Why is this on the Agenda? Each of the standing task forces of the PRB will provide this information to the Board at each open session meeting to gather feedback on the nature and timing of agenda items that will be considered in the future. The items included in this report represent an evergreen list that will be continually updated to be responsive to feedback received.

Education and Communication Task Force

Accomplished since last PRB meeting: • Assessing feedback received from the 2018 AICPA Peer Review Program conference • Beginning to plan for the 2019 conference including:

o Discussing a draft agenda, including potential concurrent session topics o Discussing potential conference case topics

• In process of updating on-demand training courses for: o Team Captain/Review Captain Ongoing training o Employee Benefit Plan Must-Select Update training o Governmental Must-Select Update training

• Developing content for the RAB Update webcast o Optional training for existing RAB members and will be held on November 15th

from 2pm to 4pm Eastern Time o Registration Link

• Developing revised process related to selecting peer review course instructors • Executing various initiatives intended to improve the peer reviewer pool by state,

including must-select reviewers. Upcoming tasks:

• Continue to identify and implement improvements to the Peer Review website • Update content for various live seminar offerings including:

o Peer Review Update for State Societies o Becoming a Peer Review Team Captain/Review Captain o Are You Ready for Your Firm’s Peer Review?

• Continue to issue communications on an as needed basis related to various Peer Review initiatives

• Update various on-demand training offerings, including: o Initial Training for Technical Reviewers o Initial Training for RAB Members

Oversight Task Force

Accomplished since last PRB meeting:

• Approved Report Acceptance Body (RAB) observation reports, see agenda item 1.4A. • Reviewed administering entity (AE) responses to RAB observation reports • OTF members conducted AE oversight visits • Approved AE plans of administration • Monitored the Enhanced Oversight results

5

https://event.on24.com/eventRegistration/EventLobbyServlet?target=registration.jsp&referrer=&eventid=1830512&sessionid=1&key=564BF7413CBE7A86DE86E968A2D81026&regTag=&sourcepage=register

2

• Reviewed sample of Enhanced Oversight reports for consistency • Discussed type of feedback issued by AEs as a result of the Enhanced Oversights • Monitored reviewer performance • Approved the 2018 AICPA Annual Report on Oversight

Upcoming tasks:

• Approve RAB observation reports • OTF members will conduct AE oversight visits • Approve responses from AEs to AE oversight visit reports • Monitor results of Enhanced Oversights • Monitor reviewer performance • Develop guidance for Program administration non-compliance and fair procedures • Review AE benchmark reports and feedback received • Review 2019 plans of administration • Revise Oversight Handbook Chapter 3 – State Board of Accountancy Peer Review

Oversight Committees (PROC)

Standards Task Force

Accomplished since last PRB meeting:

• Approved the revised effective date of the Annual PRI • Discussed the impact of SSARS No. 24 on peer review guidance and checklists • Discussed the sufficiency of the risk assessment questions in peer review engagement

checklists and determined that enhancements were necessary • Determined no changes to guidance were necessary when a nonconforming

engagement is not referenced in an FFC or in the peer review report • Determined that no changes to guidance are necessary related to the evaluation of

issues that only pertain to the firm’s system of quality control (in other words, no non-conforming engagements exist), in particular issues related to a firm’s monitoring policies and procedures. However, Staff are evaluating the need for additional educational efforts and other communications in this area.

• Continued discussions related to the project to clarify the peer review standards. See additional information provided at Agenda Item 1.4B

Upcoming tasks: • Continued focus on the clarity project, see additional information provided at Agenda

Item 1.4B • Revisions to the SRM to remove duplicate information requested in PRIMA • Revisions to Interpretation 6-8 due to SSARS 24 impact to peer review • Revisions to peer review engagement checklists related to questions on risk assessment • Revisions to guidance related to Broker-Dealers • Continued consideration of QCM review guidance revisions • A discussion of how peer review guidance should address Cybersecurity advisory

services • Assessment of guidance needed in response to the implementation of PRIMA;

o Risk Assessment Toolkit in narrative form

6

Agenda Item 1.4A

Summary of RAB Observations

Why is this on the Agenda? Comparative summary of RAB observations performed by staff during the period from January 1 through September 30, 2018 and 2017. Three RAB observations are expected to be performed for each of the current AEs during 2018; including OTF AE Oversight Visits, where applicable. Summary of RAB Observations The chart below summarizes comparative statistics for observations performed by staff with RAB observation reports approved during the period from January 1 through September 30, 2018 and 2017.

January 1 through September 30, 2018

January 1 through September 30,

2017 RAB meetings 50 50 AEs 32 29 Peer Reviews 206 161 Peer Reviewers 161 136 Based on observers’ comments:

Acceptance delayed or deferred 44 26 Feedback forms issued 14 12

OTF requested AE response due to results of RAB observation 24 5

Note: As approved by the OTF in February 2018 and beginning with reports issued in April, responses are requested regarding the outcome of reviews where the observer’s comments resulted in, or contributed to, the RAB’s decision to defer acceptance. Analysis of RAB Observation Report Results and Comments 44 of the 50 RAB observation reports approved through September 30, 2018 included observer comments; compared to 29 of 30 reports as of June 30, 2018. The following is a summary of comments per reports approved through September 30, 2018: Comment Count 1 2-4 5-7 8-10 AE Reports 7 23 10 4

7

The most pervasive comments in those 40 reports approved and issued in 2018 include the following (frequency):

Comment Category Frequency

(# and rate of occurrences)

• Peer review documents were not completed in accordance with standards or were insufficient for RAB to conclude 35 80%

• FFC, deficiency, or significant deficiency did not include an appropriate systemic cause and/or firm response 23 52%

• Technical reviewer failure to identify significant technical issues resulted in delay or deferral in 50% or more of the reviews in the observer’s sample 15 34%

• Reviewer feedback or pervasive performance issues 11 25% • Reviewer responsibilities for firm remediation of

nonconforming engagements 10 23% • Decision letters not issued or not issued timely 9 20% • Reviewer Scope and Selections (including must-selects and

must-covers) 8 18% • Reviewer identification of repeat findings and/or

deficiencies 8 18% Recurring RAB observation comments:

• Potential issue regarding auditor compliance with the independence, including documentation, requirements of Government Auditing Standards (Yellow Book).

• Reviewers’ risk assessments were not comprehensive. Items not addressed include: o unique risks associated with employee benefit plan audits when the firm had

multiple types o evidence of multiple office locations, namely in multiple states, and consideration

of auditing & accounting engagements that may be performed in such offices o reliance on quality control materials (QCM) used by the firm, including those

internally developed, that were not subject to a QCM review or covered by a non-pass QCM review report

• Firms’ response on the FFC forms were not written systemically and did not address all elements required by PRP guidance.

• Systemic cause missing or conflicted with the firm’s response or other peer review documentation.

• MFC forms included specific reviewer, firm or client names. • Firm representation letters were inconsistent current guidance, including the illustration

in Appendix B of the Standards. • Report language was inconsistent with current standards • Reviewer did not expand scope in accordance with standards and guidance • Firm representation letter, letter of response and FFC responses did not appropriately

address nonconforming engagements. • Reviews included on the consent agenda or otherwise accepted without presentation

and discussion did not comply with RAB Handbook guidance • Reviewer performance feedback not initially recommended when:

8

o Reviewers did not appropriately aggregate and evaluate matters o Reviewers failed to identify non-conforming engagements o Oversight resulted in issues not previously detected by the reviewer o Reports and letters of response were not in compliance with standards o Significant modifications were made to review documents during technical review

process • Reviewer did not document evaluation of firm’s consideration of applicable professional

standards when addressing nonconforming engagement remediation Other comments:

• Reviews are not consistently presented to the RAB free from open technical issues. This causes the RAB to spend extra time discussing reviews which ultimately leads to deferred or delayed acceptance.

• RAB members should review criteria for “delayed acceptance” and “deferral of a review” as set forth in the RAB Handbook.

• RAB members that performed or participated in a review did not recuse themselves from the meeting when their reviews were presented.

• RAB members did not meet the training requirements as established in the RAB Handbook.

• Technical reviewers and RAB members should review RAB Handbook guidance regarding responsibilities for handling a firm’s consecutive non-pass reports

• Technical reviewer participation in review presentation and RAB deliberations exceeded role established in RAB Handbook guidance.

Administrative matters:

• Decisions were not entered and letters were not sent timely • Letters issued were inconsistent with RAB decisions (delay vs. deferral of acceptance) • Unclear whether communication regarding deferred reviews addressed all items that led

to the deferral • All required documents, or significant referenced attachments, not included in the RAB

package Board Consideration None. For informational purposes only.

9

1

Agenda Item 1.4B

Update on Clarified Peer Review Standards

Why is this on the Agenda? As discussed during several recent Peer Review Board meetings, the Standards Task Force has begun a project to clarify peer review guidance to benefit all peer review stakeholders. The STF would like to update the PRB on the progress made on this project so far. Included in the materials for open session are:

• Agenda Item 1.4C, which is the current agreed upon organizational structure of clarified peer review standards. This structure would organize guidance first by stakeholder, then by type of review (or for PR-C section 400, the role in the administration process).

• Agenda Item 1.4D, which is a working draft of PR-C section 220, Engagement Reviews

which contains guidance for reviewers performing engagement reviews. The format and style is intended to be similar to other types of guidance, for example the AU-Cs or AR-Cs, as users should be familiar with the format of these standards.

• Exhibits A through C, mapping documents used in the development of the PR-C section 220 working draft. These are included for reference purposes only and will not be discussed during open session.

o Exhibit A shows how current Standards (in other words, requirements listed in the 1000 section of the Peer Review Program Manual) are mapped to the current version of PR-C section 220.

o Exhibit B shows how current Interpretations (in other words, requirements listed in the 2000 section of the Peer Review Program Manual) are mapped to the current version of PR-C section 220.

o Exhibit C shows how instructions for reviewers performing engagement reviews (in other words, requirements listed in the 6200 section of the Peer Review Program Manual) are mapped to the current version of PR-C section 220.

To date, for 2018, the Standards Task Force has discussed this project at several of its meetings. A summary of those meetings is listed below:

• January 8-9, 2018 – An initial planning meeting for the clarity project; established the objectives of the project, scope, and broad stages of the project.

• February 1, 2018 – Determined a process to accumulate the requirements of the program • March 7, 2018 – Discussed a listing of accumulated requirements included in PRP section

1000. Between the March and May meetings STF members independently reviewed and verified the requirements, and staff reviewed for completeness and accuracy.

• May 1, 2018 – Further evaluation of the accumulated requirements from PRP section 1000. The task force also determined to perform the same process on PRP section 2000.

• June 7, 2018 – Discussion of the results of accumulating the requirements of PRP section 2000. Based on this discussion, the task force decided to revisit the organizational structure of the clarified standards.

• July 16, 2018 – The task force considered multiple options for organizational structure and decided to move forward with the structure presented in Agenda Item 1.6C, as task force members decided it best fits the objectives of the clarity project.

10

2

• September 4, 2018 – A sub task force* consisting of task force members met to review a working draft of PR-C sec. 220. The main purpose of this meeting was to determine to test out the proposed organizational structure.

• September 18, 2018 – Based on the results of the sub task force, the task force agreed to move forward with PR-C sec. 320.

Currently scheduled future meetings

• October 29, 2018 – The sub task force is meeting to review a working draft of PR-C sec. 320, which would contain guidance for firms related to engagement review

• November 14, 2018 – The entire STF is meeting to review a proposed detailed plan of next steps related to the project. This plan will likely be shared and discussed during the January PRB meeting.

* Sub Task Force members: Dawn Brenner, Paul Brown, Jerry Cross, and Barbara Lewis Board Considerations The purpose of this item is to provide an update on progress made to date related to the project to clarify the peer review standards and related guidance. While the task force is not seeking specific feedback on any given item presented at this time, PRB members and Observers are invited to ask any questions or provide any commentary deemed necessary.

11

1

Agenda Item 1.4C Proposed Format Outline with Labels for Mapping: PR-C Introduction PR-C Sec. 100 Concepts Common to All Peer Reviews PR-C Sec. 200 General Principles and Responsibilities for Reviewers

PR-C Sec. 210 System Reviews

PR-C Sec. 220 Engagement Reviews

PR-C Sec. 300 General Principles and Responsibilities for Reviewed Firms

PR-C Sec. 310 System Reviews

PR-C Sec. 320 Engagement Reviews

PR-C Sec. 400 General Principles and Administrator Responsibilities

PR-C Sec. 410 Report Acceptance Body Responsibilities

PR-C Sec. 420 Technical Reviewer Responsibilities PR-C Exhibits PR-C Appendixes PR-C Checklists The following parts would be included in each section:

• Introduction - explains the purpose and scope of the section • Objective (high level) - defines the context in which the requirements are set • Definitions (where relevant) - explains specific meanings of terms in the relevant section

of the standards • Requirements - set out what the reviewer/firm/administrator are required to do to achieve

the objective of the standard. Requirements are expressed using the words “should” or “must.”

• Application and Other Explanatory Material (cross-referenced to the requirements) - provide further explanation of, and guidance for, carrying out the requirements. (A reviewer/firm/administrator would be more likely to meet the requirement if they followed the application material.)

Additionally, each section would:

• Number application and other explanatory material paragraphs using an A- prefix and presenting them in a separate section that follows the requirements section

• Utilize formatting techniques, such as bulleted lists, to enhance readability.

12

Agenda Item 1.4D

PR-C Section 220, Engagement Reviews

Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material Introduction Scope of This Section Scope of This Section (Ref: par. .02) .01 This section contains performance and reporting requirements and application guidance for reviewers engaged to perform an Engagement Review. The requirements and guidance in this section supplement the requirements and guidance in section 100 and 200.

.02 Engagement Reviews are available to firms that perform engagements under the SSARS, and engagements under the SSAEs other than examinations. (Ref. par. .A1)

.A1 Firms eligible to have an Engagement Review may elect to have a System Review. See PR-C sec. 2XX.XX for the requirements of a System Review.

Effective Date .03 The effective date for these standards is for peer reviews commencing on or after January 1, 20XX.

Objective .04 In performing an Engagement Review, the objectives of the reviewer are to

a. evaluate whether the engagements submitted for review are performed and reported on in conformity with applicable professional standards in all material respects

b. report on the evaluation of selected engagements

Definitions .05 For the purposes of this section, the following terms have the meanings attributed as follows: Commencement. (same definition in 100). Commencement for an engagement review is considered… Deficiency. One or more matters that the review captain concludes are material to the understanding of the financial statements or information or related accountant’s reports or that represent omission

13

Prepared by: Jennifer Gum (August 2018) Page 2 of 16

Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material of a critical procedure, including documentation, required by applicable professional standards. At least one, but not all, engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. Finding. One or more matters that the review captain has concluded result in financial statements or information, the related accountant’s reports submitted for review, or the procedures performed, including related documentation, not being performed or reported on in conformity with the requirements of applicable professional standards. Matter. One or more “No” answers to questions in peer review checklist(s). Partner. (same definition in 100). A reference to partner in this section may include individuals who are responsible for the issuance of reports, or the issuance of prepared financial statements. Repeat Deficiency or Significant Deficiency. An engagement deficiency or significant deficiency that is substantially the same as noted in the prior review’s report or FFC relating to reporting, presentation, disclosure or documentation.

Repeat Finding. An engagement finding that is substantially the same as noted in the prior review report or finding relating to reporting, presentation, disclosure or documentation. Significant Deficiency. Deficiencies are evident on all engagements reviewed.

14


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material Requirements Planning Planning (Ref: par. .06) .06 The review captain should obtain from the reviewed firm (or administering entity); (Ref. par. .A2)

a. the number of engagements performed by level of service and industry for each partner;

b. inquiries of the required representations from the firm’s management (Ref to requirements);

c. the firm’s prior; 1. peer review report;

2. letter of response (if applicable);

3. letter of acceptance;

4. FFC forms (if applicable); and

5. representation letter

.A2 Engagement reviews are normally performed at a location other than the reviewed firm’s office.

Engagement Selection Engagement Selection (Ref: par. .07) .07 The review captain should select: (Ref. par. .A3-.A4)

a. One engagement from each of the following areas of service performed by the firm:

1. Review of financial statements (performed under SSARSs)

.A3 The engagement selection requirements are not mutually exclusive. The objective of those requirements is to select one engagement from each partner and one engagement from each level of service listed in .07a for the firm. .A4 Engagement selection may also include consideration of industries.

15


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material 2. Compilation of financial statements, with

disclosures (performed under SSARSs)

3. Compilation of financial statements that omits substantially all disclosures (performed under SSARSs)

4. Engagements performed under the SSAEs other than examinations

b. One engagement from each partner, or individual of the firm if not a partner, responsible for the issuance of reports listed in item a.

c. At least two engagements, unless only one is performed.

.08 Preparation engagements should only be selected in the following instances:

a. One preparation engagement with disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item .07a or when the firm’s only engagements with disclosures are preparation engagements.

b. One preparation engagement that omits substantially all disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item .07a or when the firms only omit disclosure engagements are preparation engagements.

16


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material c. One preparation engagement should be selected if

needed to meet the requirement in item .07a. .09 A reviewer should only select the number of engagements needed to meet the requirements in par. .07 -.08.

Evaluation of Engagements .10 The reviewer should evaluate each engagement submitted for

review. The evaluation should include the following:

a. Consideration of the financial statements or information and the related accountant’s report on the engagements performed under SSARS and SSAEs

b. Consideration of the documentation on the engagements performed via reviewing background and engagement profile information, representations made by the firm, and inquiries

c. Review of all other documentation required by applicable professional standards on the engagements

.11 For each engagement reviewed, the review team should use peer review checklists and questionnaires that document the following:

a. The financial statements were not in conformity with GAAP in all material respects or, if applicable, with a special purpose framework and the accountant’s report was not appropriately modified.

fn 5 See footnote 3.

17


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material b. The firm did not perform or report on the engagement in

all material respects in accordance with SSARS or SSAEs. Identifying, Evaluating and Aggregating Matters, Findings, Deficiencies, and Significant Deficiencies

Identifying, Evaluating and Aggregating Matters, Findings, Deficiencies, and Significant Deficiencies (Ref: par. .12, .18, .19)

.12 The reviewer should determine the relative importance of matters noted during the review, individually and in the aggregate. (Ref. par. .A5-.A6)

.A5 Exhibit B .A6 Depending on the resolution of a matter and the process of aggregating and evaluating peer review results, a matter may develop into a finding. Findings will also be evaluated, and after considering their nature and relative importance, including whether they are material to the understanding of the report or financial statements or represent the omission of a critical procedure including documentation, may not get elevated to a deficiency. Alternatively, a matter may develop into a deficiency. That deficiency may or may not be further elevated to a significant deficiency.

.13 A reviewer should document a matter on a Matter for Further Consideration (MFC) when the reviewer identifies one or more “No” answers to peer review engagement checklists.

.14 A reviewer should document a finding on a Finding for Further Consideration (FFC) when the reviewer concludes the submitted engagement(s) was not performed or reported on in conformity with the requirements of the applicable standards but does not rise to the level of a deficiency or significant deficiency.

.15 A reviewer should document a deficiency in the report when the reviewer concludes at least one, but not all, engagements submitted for review were not performed or reported on in conformity with the requirements of the applicable standards in all material respects.

.16 A reviewer should document a significant deficiency in the report when the reviewer concludes all engagements submitted for review were not performed or reported on in conformity with requirements of the applicable standards in all material respects.

18


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material .17 A review captain should complete a Disposition of Matter for Further Consideration (DMFC) for all MFCs indicating whether it was:

a. cleared,

b. discussed with the firm,

c. included on a specific FFC (individually or combined with other MFCs), or

d. included as a deficiency in a report with a peer review rating of pass with deficiencies or as a significant deficiency in a report with a peer review rating of fail.

.18 The review captain should promptly inform the firm on an MFC when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its obligation under professional standards to take appropriate actions. (Ref. par. .A7)

.A7 Although it is ultimately the firm’s responsibility, the review captain and firm may collaborate to determine the response. Reviewers or administering entities should not instruct firms to perform omitted procedures, reissue accounting or auditing reports, or have previously issued financial statements revised and reissued because those are decisions for the firm and its client to make.

.19 The review captain should review and evaluate the responses on the FFCs and letter of response prior to the exit conference. The review captain should consider the following: (Ref. par. ..A8 – A9)

a. the firm’s response should include;

i. the firm’s actions taken or planned to remediate the findings, deficiencies or significant deficiencies,

ii. including timing of the remediation, and

.A8 The purpose of the firm’s response on the FFC and in the letter of response is for a firm to stipulate, in writing, the specific action(s) that will be taken to correct findings, deficiencies, and significant deficiencies noted by the reviewer. .A9 The administering entity’s peer review committee (committee) may require the firms to make and document appropriate considerations regarding nonconforming engagements as a condition of acceptance of the peer review. The firm’s response may affect other monitoring actions the committee may impose, including actions to verify that the firm adheres to the intentions indicated in its response.

19


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material iii. additional procedures to ensure the finding,

deficiency, or significant deficiency is not repeated in the future

b. the action should be feasible, genuine, and comprehensive

c. If the firm has taken action, the review team should review documentation of actions taken and consider whether the action is appropriate. (Ref. par. .A10)

.A10 Examples of firm actions taken in response to nonconforming engagements may include, but not be limited to;

a. omitted procedures performed,

b. reissued report and financial statements, or c. notification to users to discontinue use of previously

issued reports)

.21 The review captain should be familiar with the firm requirements in PR-C sec. 320. Communication Requirements for Closing Meeting and Exit Conference

Communication Requirements for Closing Meeting and Exit Conference (Ref: par. .22)

.22 Prior to issuing the report or finalizing MFC and FFC form(s), if applicable, the review captain should communicate his or her conclusions to the firm at a closing meeting. The review captain should discuss the following during the closing meeting: (Ref. par. .A11-.A13)

a. Preliminary peer review results, including any matters, findings, deficiencies or significant deficiencies, and the type of report to be issued.

b. The firm’s requirement to respond to the MFC form(s), FFC form(s), or the deficiency(ies) or significant deficiency(ies) included in the peer review report.

c. The firm’s required written representations

d. Other suggestions and observations for the firm to consider. For example, implications of upcoming changes in professional standards, operational or

.A11 The closing meeting and exit conference are normally held via teleconference and may also be attended by representatives of the administering entity, the board, AICPA staff, or other board authorized organizations with oversight responsibilities. .A12 The purpose of a separate closing meeting and exit conference is to provide the firm sufficient time to determine appropriate responses to the matters, findings, deficiencies, and significant deficiencies identified and to provide the review captain with sufficient time to assess the firm’s responses prior to the report date (exit conference date). If these steps have been taken prior to the closing meeting or are not necessary, the closing meeting and exit conference may be combined. .A13 Team members may participate in or be available for the closing meeting and exit conference. This may be useful when the review captain does not have the experience to review the industry of an engagement that was reviewed by the team member.

20


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material efficiency suggestions, and minor areas for improvement considerations.

a. Peer review noncooperation implications of consecutive non-pass report ratings, if applicable.

.23 After the firm has responded to the MFC, FFC, and deficiencies or significant deficiencies in the report and the review captain has assessed whether the responses are appropriate and has considered any additional impact to the peer review results, the review captain should communicate the results to the firm at an exit conference. The review captain should discuss the following during the exit conference:

a. Final peer review results, including any changes to the information communicated at the closing meeting after consideration of the firm’s responses to MFCs, FFCs, and deficiencies and significant deficiencies in the report.

b. The appropriateness of the firm’s response should be discussed during the exit conference.

c. Obtain and review the firm’s representation letter.

d. Potential implications of the RAB acceptance process such as corrective actions (for deficiencies and significant deficiencies) and implementation plans (for findings) that may be imposed by the RAB, if applicable. The review captain should also discuss with the firm the implications of these steps on the acceptance and completion of the peer review and the firm’s enrollment in the program.

21


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material .24 The exit conference should be held prior to the review due date. Reporting on Engagement Reviews Reporting on Engagement Reviews (Ref: par. .25, .28) .25 To determine the type of report to issue, the review captain should use the results of the evaluation of engagements reviewed. (Ref. par. .A14-.A16)

i.

.A14 A report with a peer review rating of pass is issued when the reviewer concludes that nothing came to his or her attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects. There are no deficiencies or significant deficiencies that affect the nature of the report and, therefore, the report does not contain any deficiencies or significant deficiencies. In the event of a scope limitation, a report with a peer review rating of pass (with a scope limitation) is issued. .A15 A report with a peer review rating of pass with deficiencies is issued when at least one but not all of the engagements submitted for review contain a deficiency. In the event of a scope limitation, a report with a peer review rating of pass with deficiencies (with a scope limitation) is issued. .A16 A report with a peer review rating of fail is issued when the review captain concludes that, as a result of the deficiencies described in the report, the engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. A report with a peer review rating of fail is issued when deficiencies are evident on all of the engagements submitted for review. The review captain should not expand scope beyond the original selection of engagements in an effort to change the conclusion from a peer review rating of fail in these circumstances. In the event of a scope limitation, a report with a peer review rating of fail (with a scope limitation) is issued.

.26 The review captain should provide the reviewed firm with a written report within 30 days of the exit conference date or by the firm’s peer review due date, whichever is earlier.

22


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material .27 The review captain’s report should indicate whether the

engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

.28 The written report in an Engagement Review should: (Ref. par. .A17)

a. Be dated as of the exit conference date

b. Be issued on letterhead of the firm performing the reviewi

c. State at the top of the report the title “Report on the Firm’s Conformity With Professional Standards on Engagements Reviewed.”

d. Include headings for each of the following sections:

ii. Firm’s Responsibility

iii. Peer Reviewer’s Responsibility

iv. Deficiency(ies) or Significant Deficiency(ies) Identified on the Firm’s Conformity With Professional Standards on Engagements Reviewed, if applicable

v. Scope Limitation, if applicable

vi. Conclusion

.A17 Illustrations

23


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material e. State that the review captain reviewed selected

accounting engagements of the firm and include the year-end covered by the peer review.

f. State that the peer review was conducted in accordance with the Standards for Performing and Reporting on Peer Reviews established by the Peer Review Board of the American Institute of Certified Public Accountants.

g. State that the nature, objectives, scope, limitations of, and procedures performed in an Engagement Review as described in the Standards can be found on the AICPA website where the Standards are summarized.

h. State that the firm is responsible for designing a system of quality control and complying with it to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects and for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, where appropriate, and for remediating weaknesses in its system of quality control, if any.

i. State that the reviewer’s responsibility is to evaluate whether the engagements submitted for review were performed and reported on in conformity with applicable professional standards in all material respects.

j. State that an Engagement Review does not include reviewing the firm’s system of quality control and

.A18 An Engagement Review does not include tests of the firm’s administrative or personnel files, interviews of selected firm

24


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material compliance therewith and, accordingly, the reviewers express no opinion or any form of assurance on that system. (Ref. par. .A18)

k. In the event of a scope limitation, include an additional paragraph before the last paragraph that describes the relationship of the excluded engagement(s) to the firm’s practice, the highest level of service and industry concentration, if any, of the engagement(s) excluded from the potential selection, and the effect of the exclusion on the scope and results of the peer review. Tailor the conclusion, as appropriate, to address the scope limitation.

l. Identify the different peer review ratings that the firm could receive.

m. In a report with a peer review rating of pass, state:

vii. That nothing came to the review captain’s attention that caused the review captain to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

viii. That the firm has received a peer review rating of pass.

n. In a report with a peer review rating of pass with deficiencies, state:

personnel, or other procedures performed in a System Review. Accordingly, an Engagement Review does not provide the review captain with a basis for expressing any form of assurance on the firm’s system of quality control for its accounting practice.

25


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material ix. That because of the deficiencies previously

described, the review captain believes that at least one but not all the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

x. That the firm has received a peer review rating of pass with deficiencies.

o. In a report with a peer review rating of fail, state;

xi. That because of the deficiencies previously described, the review captain believes that all the engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects.

xii. That the firm has received a peer review rating of fail.

p. In a report with a peer review rating of pass with deficiencies or fail:

xiii. Include descriptions of the deficiencies or significant deficiencies (each of these should be numbered).

xiv. If there are any repeat deficiencies or significant deficiencies, state that the deficiency [or significant deficiency, as

26


Introduction, Objectives, Definitions, and Requirements Application and Other Explanatory Material applicable] was noted in the firm’s previous peer review. (Ref. par. .A19)1

xv. Identify the level of service for any deficiencies or significant deficiencies. If the deficiency or significant deficiency is industry specific, also identify the industry.

.A19 An example of a repeat deficiency or significant deficiency may be if a reviewer notes an engagement that had a disclosure or a financial statement presentation deficiency in a prior review report or prior year FFC, the disclosure or financial statement presentation deficiency noted in the current review would need to be substantially the same disclosure or financial statement presentation deficiency to qualify as a repeat.

Submission of Peer Review Documentation to the Administering Entity by the Review Captain

Submission of Peer Review Documentation to the Administering Entity by the Review Captain (Ref: par. .29)

.29 Within 30 days of the exit conference date or by the firm’s peer review due date, whichever date is earlier, the review captain should submit or complete electronically, as applicable, the following documents to the administering entity. (Ref. par. .A20)

a. Report and letter of response, if applicable

b. Review Captain Summary

c. Review Summary

d. FFCs, if applicable

e. MFCs

f. DMFCs

g. Firm’s representation letter

.A20 All peer review working papers are subject to oversight procedures and may be requested later.

.30 Electronic completion is required for some documentation.

1 If there are repeat deficiencies or significant deficiencies that have occurred on two or more prior reviews the reviewer should state in the current report that, “this deficiency [or significant deficiency, as applicable] was noted on previous reviews.”

27


i A report by a review team formed by an association of CPA firms should be issued on the letterhead of the firm of the review captain performing the review. Other reports are issued on the letterhead of the administering entity.

28

ANNUAL REPORT ON OVERSIGHT

IssuedOctober 4, 2018

Agenda Item 1.10A

29

Copyright © 2018 by American Institute of Certified Public Accountants, Inc. New York, NY 10036-8775 All rights reserved. For information about the procedure for requesting permission to make copies of any part of this work, please email [email protected] with your request. Otherwise, requests should be written and mailed to the Permissions Department, 220 Leigh Farm Road, Durham, NC 27707-8110.

30

TABLE OF CONTENTS Introduction .......................................................................................................................... i

Letter to the AICPA Peer Review Board ..................................................................................... 1

PRB Oversight Process ............................................................................................................. 3

Exhibit 1 – Administering Entities Approved to Administer the 2017 Program .......................14

Exhibit 2 – On-Site Oversights of Administering Entities Performed by the AICPA Oversight Task Force .......................................................................................................................15

Exhibit 3 – Observations From On-Site Oversights of Administering Entities Performed by the AICPA Oversight Task Force ..............................................................................................16

Exhibit 4 – Comments From RAB Observations Performed by the AICPA Peer Review Program Staff and OTF Members .........................................................................................18

Exhibit 5 – Material Departures From Professional Standards Identified by SMEs ................19

Exhibit 6 – Overall Nonconforming Engagements Identified During 2016 Partial-Year Enhanced Oversights by Firm Size .......................................................................................21

Exhibit 7 – Nonconforming Engagements Identified During 2017 Enhanced Oversights by Firm Size .......................................................................................................................22

Exhibit 8 – Administrative Oversights Performed by the Peer Review Committee of Administering Entities ............................................................................................................23

Exhibit 9 – Summary of Oversights Performed by Administering Entities ..............................24

Exhibit 10 – Summary of Reviewer Resumes Verified by Administering Entities ...................25

Appendix 1 – History of Peer Review at the AICPA. ..........................................................26

Appendix 2 – AICPA Peer Review Program Overview. .....................................................28

Glossary .......................................................................................................................30

31

i

Introduction Purpose of This Report The purpose of this Annual Report on Oversight (report) is to provide a general overview, including statistics and information, of the results of the AICPA Peer Review Program (Program) oversight procedures and to conclude whether the objectives of the AICPA Peer Review Board’s oversight processes performed in calendar year 2017 were compliant with the requirements of the Program. Years Presented in This Report As a result of the transition to the Peer Review Information Management Application system, the software program is currently unable to generate certain quantitative statistics that were included in previous oversight reports. Accordingly, this report includes results of Program oversight procedures performed in calendar year 2017. Overall Program statistics for reviews performed in 2017 are not included in the report.

32

1

Letter to the AICPA Peer Review Board To the members of the AICPA Peer Review Board: We have performed comprehensive oversight procedures during the 2017 calendar year. In planning and performing our procedures, we considered the objectives of the oversight program, which state that there should be reasonable assurance that (1) administering entities (AEs) are complying with the administrative procedures established by the Peer Review Board (PRB) as set forth in the AICPA Peer Review Program Administrative Manual; (2) the reviews are being conducted and reported upon in accordance with the AICPA Standards for Performing and Reporting on Peer Reviews (Standards); (3) the results of the reviews are being evaluated on a consistent basis by all AE peer review committees; and (4) the information provided via the internet or other media by AEs is accurate and timely. Our responsibility is to oversee the activities of AEs that elect and are approved to administer the AICPA Peer Review Program (Program), including the establishment and results of each AE’s oversight processes. As a result of the transition to the Peer Review Information Management Application, the software program is currently unable to generate complete program statistics for reviews performed in 2017. This report only includes the results of Program oversight procedures performed in the 2017 calendar year. Our procedures were conducted in conformity with the guidance contained in the AICPA Peer Review Program Oversight Handbook and included the following procedures:

• Oversight visits of administering entities. Visits to the AEs, on a rotating basis, ordinarily every other year, by a member of the Oversight Task Force (OTF). The visits included testing the administrative and report acceptance procedures established by the PRB. OTF members visited 18 AEs in 2017. See pages 3–4, “Oversight Visits of the Administering Entities.”

• Report Acceptance Body (RAB) observations. RAB observations are performed by OTF members and Program staff. The RAB observations increase the probability that the report acceptance process is being conducted in accordance with Standards and guidance. For 2017, 253 reviews were selected for RAB observations. See pages 4–5 for a detailed description of the RAB observation process.

• Enhanced oversight. Oversights performed by subject matter experts on must-select engagements that include the review of financial statements and working papers for the must-select engagements. See pages 5–10 for a detailed description of the enhanced oversight process.

Oversight procedures performed by the AEs in accordance with the AICPA Peer Review Program Oversight Handbook included the following procedures:

• Administrative oversight of the AE. Administrative oversight performed by a peer review committee member in the year in which there was no oversight visit by a member of the OTF. Twenty-one administrative oversights were performed in 2017. See pages 10–11, “Administrative Oversight of the AE.”

• Oversight of peer reviews and reviewers. Oversight of various reviews, selected based on reviewed firm or peer reviewer, subject to minimum oversight requirements of the PRB. For 2017, 227 reviews were selected for oversight at the AE level. See pages 11–12, “Oversight of the Peer Reviews and Reviewers.”

33

2

• Annual verification of reviewers’ resumes. Verification of accuracy of information included on peer reviewer resumes. For 2017, resumes were verified for 577 reviewers. See page 12, “Annual Verification of Reviewers’ Resumes.”

Based on the results of the oversight procedures performed, the OTF has concluded, for the oversight initiatives performed in the 2017 calendar year, that the objectives of the PRB oversight program, taken as a whole, were met. Respectfully submitted, Brian Bluhm

Brian Bluhm, Chair Oversight Task Force AICPA Peer Review Board

34

3

PRB Oversight Process The Peer Review Board (PRB) is responsible for oversighting all administering entities (AEs). In turn, each AE is responsible for overseeing peer reviews and peer reviewers for the states they administer. This responsibility includes having written oversight policies and procedures. All state boards of accountancy (SBAs) that require peer review accept the AICPA Peer Review Program (Program) as a program satisfying their peer review licensing requirements. Some SBAs oversight AEs’ administration of the Program. This report is not intended to describe or report on that process. Objectives of PRB Oversight Process The PRB has appointed the Oversight Task Force (OTF) to oversee the administration of the oversight program and make recommendations regarding oversight procedures. The main objectives of the OTF are to provide reasonable assurance that:

• The AEs are complying with the administrative procedures established by the PRB, • Reviews are being conducted and results of reviews are being evaluated and reported on

in accordance with the AICPA Standards for Performing and Reporting on Peer Reviews (Standards) and on a consistent basis in all jurisdictions and

• Information provided to firms and reviewers (via the internet or other media) by AEs is accurate and timely.

The oversight program also establishes a communications link with AEs and builds a relationship that enables the PRB to accomplish the following:

• Obtain information about problems and concerns of AEs’ peer review committees, • Provide consultation on those matters to specific AEs and • Initiate the development of guidance on a national basis, when appropriate.

OTF Oversight Procedures The following oversight procedures were performed as a part of the OTF oversight program. Oversight Visits of the Administering Entities Description Each AE is visited by a member of the OTF (ordinarily, at least once every other year). No member of the OTF is permitted to visit the AE in the state that his or her main office is located, where he or she serves as a technical reviewer or may have a conflict of interest (for example, performing the oversight of the AE that administers the OTF member’s peer review), or where he or she performed the most recently completed oversight visit.

Oversight Visit Procedures

During these visits, the member of the OTF will:

• Meet with the AE’s peer review committee during its consideration of peer review documents,

35

4

• Evaluate a sample of peer review documents and applicable working papers on a post-acceptance basis, as needed,

• Perform face-to-face interviews with the administrator, committee chair, and technical reviewers and

• Evaluate the various policies and procedures for administering the Program.

As part of the visit, the OTF member will request that the AE complete an information sheet that documents policies and procedures in the areas of administration, technical review, peer review committee, report acceptance, and oversight processes in administering the Program. The OTF member evaluates the information sheet, results of the prior oversight visit, and comments from report acceptance body (RAB) observations to develop a risk assessment. A comprehensive oversight work program that contains the various procedures performed during the oversight visit is completed with the OTF member’s comments. At the conclusion of the visit, the OTF member discusses any comments and issues identified as a result of the visit with the AE’s peer review committee. The OTF member then issues an AICPA Oversight Visit Report (report) to the AE that discusses the purpose of the oversight visit and that the objectives of the oversight program were considered in performing those procedures. The report also contains the OTF member’s conclusion regarding whether the AE has complied with the Program’s administrative procedures and Standards in all material respects.

In addition to the aforementioned report, the OTF member issues the AE an AICPA Oversight Visit Letter of Procedures and Observations (letter) that details the oversight procedures performed and observations noted by the OTF member. The letter also includes recommendations that may enhance the quality of the AE’s administration of the Program. The AE is then required to respond to the chair of the OTF, in writing, to any findings reported in the report and letter or, at a minimum, when there are no findings reported, an acknowledgement of the visit. The oversight documents, including the report, the letter of procedures and observations, and the AE’s response, are presented to the OTF members for acceptance. The AE may be required to take corrective actions as a condition of acceptance. The acceptance letter would reflect corrective actions, if any. A copy of the acceptance letter, the report, letter of procedures and observations, and the response are posted to the following Program web page: www.aicpa.org/interestareas/peerreview/resources/transparency/oversight/oversightvisitresults.html

Results For the years 2016 and 2017, a member of the OTF performed at least one on-site oversight visit to each AE (excluding the National Peer Review Committee [NPRC]). See exhibit 2 for a listing of the 39 AE oversight visits performed for 2016 and 2017. See exhibit 3 for a summary of observations from the on-site oversight visits performed during the two years.

RAB Observations Description The purpose of the RAB observation is to determine whether:

• The RAB is performing its responsibilities; • Technical reviewers are performing their responsibilities; • Reviews are being conducted and reported on in accordance with the Standards and

guidance;

36

5

• Administrative procedures established by the PRB are being complied with; • Information is being entered into the computer system correctly and • Results of reviews are being evaluated on a consistent basis within an AE and in all

jurisdictions.

The objective of RAB observations is to provide real-time feedback to the RABs to improve overall quality and consistency of the RAB process. The process for the RAB observations is similar to the process used during the oversight visits. The RAB observer receives the materials that will be presented to the RAB prior to the RAB meeting. The observer selects a sample of reviews of firms enrolled in the Program from the package and reviews the materials that will be presented to the RAB. The observer notes any issues or items that are unclear for each review selected. During the RAB review, the observer allows the RAB to deliberate each review. If the RAB does not address the items noted by the observer, the observer will bring those items to the RAB’s attention prior to the RAB voting on whether to accept the review. All significant items that were noted by the observer, but not noted by the RAB, are included as comments in the RAB observation report. The OTF approves the report, and it is submitted to the AE peer review committee for its consideration. The OTF may request a response from the peer review committee based on the results of the RAB observations. Peer review committees may also choose to respond to the report, if not requested by the OTF.

Results For 2017 and 2016, each AE had at least one RAB observation. RAB observations were performed by OTF members as well as Program staff. Recurring comments generated by RAB observations are summarized in exhibit 4. Results for the year ended 2017 and 2016 RAB observations are as follows:

2017 2016 RAB meetings observed 63 104 AEs observed 34 40 Peer reviews observed 253 392 Peer Reviewers 195 287 Based on observers’ comments: Acceptance delayed or deferred 43 135 Feedback forms issued 17 24 Monitoring letter Issued - 1 OTF requested AE response due to results of RAB observation 7 8

Fewer RAB observations were performed in 2017 due to the challenges transitioning to the newly implemented PRIMA system. Enhanced Oversights Description In May 2014, the PRB approved the addition of enhanced oversights performed by subject matter experts (SMEs). For 2017, the SMEs consisted of members of the applicable Audit Quality Center

37

6

executive committees and expert panels, PRB members, former PRB members, individuals from firms that perform a large number of engagements in a must-select category, and individuals recommended by the Audit Quality Center executive committee and expert panel members. The enhanced oversights are one element of the AICPA’s Enhancing Audit Quality (EAQ) initiative.

The oversights are intended to increase confidence in the peer review process, identify areas that need improvement, and provide meaningful data to inform other EAQ activities. As a result of the oversights, the PRB has approved multiple initiatives to improve reviewer performance on must-select engagements, including additional training requirements for reviewers and additional RAB observations with emphasis on must-select engagements. The results of the enhanced oversight findings are shared with other teams at the AICPA to further the goal of improving audit quality.

The results for the 2016 partial-year sample (August 1, 2016 to December 31, 2016) and the 2017 calendar-year sample are presented in this report. Both oversight samples have been completed since the issuance of the previous oversight report.

The objective of the enhanced oversight is to increase the probability that peer reviewers are identifying all material issues in must-select engagements, including whether engagements are properly identified as nonconforming. This objective is achieved through the selection of two samples. The first sample is a statistically valid random sample that will achieve a 90 percent to 95 percent confidence level. The second sample is a risk-based sample (targeted) based on certain risk criteria established by the OTF. For the two oversight years presented in this report, the random samples were not statistically valid (as discussed further below), and the results are presented as one sample.

The enhanced oversights focus exclusively on must-select engagements (engagements performed under Government Auditing Standards, audits of employee benefit plans, audits performed under the Federal Deposit Insurance Corporation Improvement Act [FDICIA], audits of carrying broker-dealers, and examinations of service organizations). For Government Auditing Standards engagements with Single Audit Act/Uniform Guidance portions of the engagement, the oversight focused only on the Single Audit Act/Uniform Guidance portion of the audit. These oversights will neither replace nor reduce the number of oversights currently required by AEs.

Enhanced Oversight Process

The enhanced oversight process consists of the review of the financial statements and working papers by the SME for the engagement selected. Program staff notifies the peer reviewer and the firm that they have been selected for oversight once the peer review working papers and report have been submitted to the AE. The peer reviewer is not aware that he or she has been selected for oversight until after the peer reviewer has completed work on the review. The SME reviews the same working papers and compares the results to the results of the peer reviewer. The SME issues a report detailing any material items not identified by the peer reviewer. If the peer reviewer failed to identify a nonconforming engagement, the peer reviewer would complete a letter of response (LOR) detailing whether he or she agrees with the oversight report and lists any additional procedures that he or she will perform. The report and LOR (if applicable) are provided to the AE for consideration during the report acceptance process. If the peer reviewer disagrees with the results of the oversight, the AE will follow the disagreement guidance in the RAB Handbook. Program staff monitors the effects of the oversights on the peer review results (change from “pass” to “pass with deficiency” or “pass with deficiency” to “fail”), and the type of reviewer feedback (feedback form or performance deficiency letter), if any, is issued to the peer reviewer.

38

http://www.aicpa.org/InterestAreas/PeerReview/Pages/EAQ.aspx

7

OTF Review of Oversight Reports

The OTF reviews a majority of the oversight reports in which the peer reviewer failed to identify a nonconforming engagement after the report is issued. The OTF reviews the reports for consistency and to verify that the items identified by the SME are material departures from professional standards. The OTF provides feedback to Program staff to improve future reports. Enhanced Oversight Samples The following are the two most recently completed oversight samples. The first sample was a partial-year sample. A partial-year sample was used to shift the oversight year from a fiscal year ending in July to a calendar year. The partial-year sample was selected from peer reviews with must-select engagements performed between August 1, 2016 and December 31, 2016. The sample was not statistically valid and will not be compared to the baseline sample that follows. For the partial-year sample, 108 reviews were selected for enhanced oversight (41 random and 67 targeted selections). Ninety-eight different team captains were selected for oversight through the random and targeted samples.

The second sample was selected from peer reviews performed in calendar year 2017 (January 1, 2017 to December 31, 2017) that included must-select engagements. This sample was not statistically valid and will not be compared to the following baseline sample due to the limitations of the PRIMA system. For the 2017 sample, 87 reviews were selected for enhanced oversight (54 random and 33 targeted selections). Seventy-five different team captains were selected for oversight through random and targeted samples.

The must-select engagements selected for oversight consisted of the following:

Engagement Type 2017 2016 Partial Year Employee Benefit Plans 41 56 Single Audit/Uniform Guidance 39 47

Government Auditing Standards

5 3

Carry Broker-Dealer 1 - SOC 1 2 Total 87 108

Exhibit 5 provides a listing of items identified by SMEs that were not identified by the peer reviewer that, either individually or in the aggregate, led to a nonconforming engagement. Exhibits 6 and 7 show the percentage of nonconforming engagements identified based on the number of must-select engagements performed by the firm in the category selected. Only one engagement was reviewed for each firm selected, and the SME did not expand the scope of the oversight. Refer to the following section for further discussion of the sample selection.

The results of the subsequent samples will be presented in future oversight reports.

39

8

Random (Baseline) Sample In previous oversight years, a statistically valid random sample was selected in order to achieve a 95 percent confidence rating for the population as a whole. This means that the sample has a 95 percent chance of representing the overall population. The results of this random sample of oversights were used as a benchmark to measure audit quality improvements over time.

For the 2016 partial-year sample and the calendar-year 2017 sample, the random samples were not statistically valid. Therefore, these random samples are not presented separately and are not compared to the prior baseline samples.

Risk-Based Sample

Each oversight year, a risk-based sample (targeted) is selected based on certain risk criteria established by the OTF to target peer reviews that are considered higher risk. If a team captain is selected twice during the random sample, he or she is not selected for the targeted sample to limit the number of times a team captain can be selected for oversight each oversight year.

2016 Partial-Year Sample

For the 2016 partial-year sample (August 1, 2016 to December 31, 2016), 108 reviews were selected for enhanced oversight (41 random and 67 targeted selections). The targeted selections consisted of a sample of firms and peer reviewers that perform 2 or fewer engagements in the must-select category chosen for oversight, individuals selected for oversight for the 2014 sample that missed a nonconforming engagement who were not oversighted in the 2015 sample, and reviewers who performed 10 or fewer reviews in the 3 previous calendar years.

2016 Partial-Year Sample Results:

Engagements Selected

Number of Nonconforming Engagements Identified by

Peer Reviewer %

Number of Nonconforming Engagements Not Identified

by Peer Reviewer %

Total Nonconforming Engagements %

108 18 17% 20 18% 38 35% Although the partial-year results are not statistically valid, they indicate that peer reviewer performance has improved from the first oversight year (calendar-year 2014). For the 2016 partial year, peer reviewers identified 18 of the 38 (47%) nonconforming engagements. In the pilot year of the oversights, for the overall sample, peer reviewers only identified 7 of the 40 (18%) nonconforming engagements. This is a significant improvement in peer reviewer performance.

2017 Sample

For the calendar-year 2017 sample, 87 reviews were selected for enhanced oversight (54 random and 33 targeted selections). The targeted selections consisted of a sample of firms and peer reviewers that perform 2 or fewer must-select engagements and a selection of firms that received non-pass peer review reports on their prior peer reviews that included must-select engagements.

40

9

If a team captain was selected twice during the random sample, he or she was not selected for the targeted sample.

2017 Sample Results:

Engagements Selected

Number of Nonconforming Engagements Identified by

Peer Reviewer %

Number of Nonconforming Engagements

Not Identified by Peer Reviewer %

Total Nonconforming Engagements %

87 27 31% 16 18% 43 49% Although the 2017 results are not statistically valid, the results indicate that peer reviewer performance has continued to improve from the first oversight year (calendar-year 2014). For the 2017 calendar year, peer reviewers identified 27 of the 43 (63%) nonconforming engagements. In the first oversight year (2014), for the overall sample, peer reviewers only identified 7 of the 40 (18%) nonconforming engagements. This is a significant improvement in peer reviewer performance.

Reviewer Performance Improvements

Based on an analysis of the 2017 sample, the oversights have resulted in considerable improvement in peer reviewer performance. Program staff reviewed the material departures from professional standards identified by the peer reviewers for the 2017 sample and compared the results to the first oversight sample from 2014. For single audit engagements selected for the 2017 sample, the material departure from professional standards most frequently identified by the peer reviewers was a lack of documentation and testing of internal controls over compliance. For ERISA engagements selected for the 2017 sample, the material departure from professional standards most frequently identified by peer reviewers was SOC engagement documentation or overreliance on the SOC to eliminate testing. These material departures were the departures most frequently missed by peer reviewers in the first enhanced oversight sample from 2014. The PRB’s focus on oversight and reviewer education appears to have led to significant improvements in peer reviewer performance.

Feedback Issued

The OTF monitors the types of feedback issued as a result of the oversights. If an AE does not issue a reviewer performance deficiency or a deficiency letter, the OTF considers if any further actions are necessary, including whether to issue a reviewer performance deficiency or deficiency letter to the peer reviewer. A reviewer performance deficiency is issued when a peer reviewer fails to identify a nonconforming engagement and does not demonstrate sufficient knowledge and experience required to review the engagement. A deficiency letter is issued when a peer reviewer has a pattern of reviewer performance findings. For the oversights in which a nonconforming engagement was not identified by the peer reviewer, the following feedback was issued by the AE:

41

10

Type of Feedback 2017 2016 Partial Year Reviewer Performance Deficiency 5 8

Deficiency Letter - 1 Feedback Form 4 1 No Feedback 5 6 RAB Process Not Completed 2 4 Total 16 20

Overall, for the 2016 partial-year sample and the 2017 sample, there were 20 and 16 engagements, respectively, selected for oversight that the SME deemed nonconforming that were not identified as nonconforming by the peer reviewer. Some of the reviews selected for oversight have not completed the RAB process as of the date of this report, including consideration of feedback. The delay in consideration of feedback is either due to the firm or peer reviewer not cooperating with the process, or the peer reviewer disagreed with the result of the oversight, which resulted in a delay in the acceptance of the peer review and consideration of feedback.

Oversight by the Administering Entities’ Peer Review Committees The AEs’ peer review committees are responsible for monitoring and evaluating peer reviews of those firms whose main offices are located in their licensing jurisdiction(s). Committees may designate a task force to be responsible for the administration and monitoring of its oversight program. AEs are required to submit their oversight policies and procedures to the PRB on an annual basis. In conjunction with AE personnel, the peer review committee establishes oversight policies and procedures that meet the minimum requirements (discussed on pages 10–13, “AE Oversight Procedures”) established by the PRB to provide reasonable assurance that:

• Reviews are administered in compliance with the administrative procedures established by the PRB;

• Reviews are conducted and reported on in accordance with the Standards; • Results of reviews are evaluated on a consistent basis and • Information disseminated by the AE is accurate and timely.

AE Oversight Procedures The following oversight procedures are performed as part of the AE oversight program. Administrative Oversight of the AE

Description At a minimum, a committee member or a subcommittee of the AE’s peer review committee should perform the administrative oversight in those years when there is no oversight visit by OTF. Procedures to be performed should cover the administrative requirements of administering the Program.

42

11

Results The AE submitted administrative oversight reports to the AICPA as part of the 2017 plan of administration (POA). Comments or suggestions resulting from the administrative oversights are summarized in exhibit 8. In addition, the OTF member reviewed the results of the administrative oversight during his or her oversight visit (described on pages 3–4, “Oversight Visits of the Administering Entities”) and compared the results of the administrative oversight to those noted during the OTF oversight visit.

Oversight of Peer Reviews and Reviewers Description Throughout the year, the AE selects various peer reviews for oversight. The selections can be on a random or targeted basis. The oversight may consist of completing a full working paper review after the review has been performed but prior to presenting the peer review documents to the peer review committee. The oversight may also consist of having a peer review committee member or designee visit the firm, either while the peer review team is performing the review or after the review, but prior to final committee acceptance. As part of its oversight process, the peer review committee oversees firms being reviewed as well as reviewers performing reviews. Minimum oversight selection requirements are also imposed by the PRB. Firms – The selection of firms to be reviewed is based on several factors, including the types of peer review reports the firm has previously received, whether it is the firm’s first system review (after previously having an engagement review), and whether the firm conducts engagements in high-risk industries. Reviewers – All peer reviewers are subject to oversight and may be selected based on several factors, including random selection, any unusually high percentage of pass reports as compared to non-pass reports, conducting a significant number of reviews for firms with audits in high-risk industries, performance of the peer reviewer’s first peer review, or performing high volumes of reviews. Oversight of a reviewer can also occur due to previously noted performance deficiencies or a history of performance deficiencies, such as issuance of an inappropriate peer review report, not considering significant matters, or failure to select an appropriate number of engagements. When an AE oversees a reviewer from another state, the results are conveyed to the AE of that state.

Minimum Requirements – At a minimum, the AE is required to conduct oversight on 2 percent of all reviews performed in a 12-month period, and within the 2 percent selected, there must be at least 2 system and 2 engagement reviews. The oversight selections are made throughout the year and can be on a random or targeted basis. Selections for oversight will be made by the committee chair, committee, or designated task force based on input from staff, the technical reviewer, and committee members. The oversight involves completing a full working paper review, and it may be performed on-site in conjunction with the peer review or after the review has been performed. It is recommended that the oversight be performed prior to presenting the peer review documents to the peer review committee. This allows the committee to consider all the facts prior to acceptance of the review. At a minimum, two system review oversights are required to be performed on-site. Oversights may be random or a combination of a targeted and random selection.

43

12

AEs that administer fewer than 25 system reviews annually are required to perform a minimum of 1 system review oversight on-site. If the administering entity administers fewer than 25 engagement reviews annually, a minimum of 1 must be selected for oversight. Waivers may be requested only in hardship situations, such as a natural disaster or other catastrophic event. Results For 2017, the AEs conducted oversight on 227 reviews. There were 118 system and 109 engagement reviews oversighted. Approximately 51 percent of the system oversights were conducted on-site. See exhibit 9 for a summary of oversights by AEs.

Annual Verification of Reviewers’ Resumes

Description To qualify as a reviewer, an individual must be an AICPA member and have at least 5 years of recent experience in the practice of public accounting in accounting or auditing functions. The firm(s) with whom the member is associated should have received a pass report on either its system or engagement review. The reviewer should obtain at least 48 hours of continuing professional education in subjects related to accounting and auditing every 3 years, with a minimum of 8 hours in any 1 year.

A reviewer of an engagement in a high-risk industry should possess not only current knowledge of professional standards but also current knowledge of the accounting practices specific to that industry. In addition, the reviewer of an engagement in a high-risk industry should have current practice experience in that industry. If a reviewer does not have such experience, the reviewer may be called upon to justify why he or she should be permitted to review engagements in that industry. The AE has the authority to decide whether a reviewer’s or review team’s experience is sufficient to perform a particular review.

Ensuring that reviewers’ resumes are updated annually and are accurate is a critical element in determining if the reviewer or review team has the appropriate knowledge and experience to perform a specific peer review. The AE must verify information within a sample of reviewers’ resumes on an annual basis. All reviewer resumes should be verified over a 3-year period, as long as, at a minimum, one-third are verified in year 1, a total of two-thirds have been verified by year 2, and 100 percent have been verified by year 3. Verification must include the reviewers’ qualifications and experience related to engagements performed under generally accepted government auditing standards (GAGAS), audits of employee benefit plans subject to ERISA, audits of insured depository institutions subject to the FDICIA, audits of carrying broker-dealers, and examinations of SOC 1® engagements and SOC 2® engagements, as applicable. Verification procedures may include requesting copies of their license to practice as a CPA; continuing professional education (CPE) certificate from a qualified reviewer training course; CPE certificates that document the required 48 CPE credits related to accounting and auditing to be obtained every 3 years with at least 8 hours in 1 year; and CPE certificates that document qualifications to perform audits under Government Auditing Standards, if applicable. The AE should also verify whether the reviewer is a partner or manager in a firm enrolled in the Program and whether the reviewer’s firm received a pass report on its most recently completed peer review.

44

13

Results Each AE submitted a copy of its oversight policies and procedures indicating compliance with this oversight requirement, along with a list of reviewers whose resume information was verified during 2017. See exhibit 10. Evolution of Peer Review Introduction The evolution of peer review administration is part of the AICPA’s EAQ initiative, with the objective to ultimately improve audit performance by increasing the consistency, efficiency, and effectiveness of the Program administration. Each of the state CPA societies and all peer review AEs have been integral to the success of the peer review function, which is enormous in both scope and size across the country. Their commitment to meeting the needs of practitioner members and regulators has been, and continues to be, tremendous. At the same time, the need for an evolution of peer review administration was overwhelmingly validated by stakeholder feedback. Peer review has grown and matured over the past 35 years in the marketplace, regulatory environment, and technological environment, and its evolution does not diminish the contributions of any state CPA society or AE. As the program has evolved over time, some state societies have begun to examine their role in peer review, and 10 AEs opted to discontinue administering peer review over the past 3 years and have allowed other State AEs to administer their programs. Benchmark Model

As part of evolution and the AICPA’s EAQ initiative, the PRB approved AE benchmarks to enhance overall quality and effectiveness of Program administration. The benchmarks include qualitative, objective, and measurable criteria, which may be modified over time due to advances in technology and other factors. AE benchmarks were derived from the final evolution paper released August 31, 2017, the September 20, 2017 webcast presentation for AEs and stakeholder feedback.

The benchmark model will begin with a pilot period for monitoring and reporting on the benchmarks. During the pilot period, which began on July 2, 2018 and will end on June 30, 2019, AEs will not be subject to fair procedures. For the reporting period beginning July 1, 2019, AEs will be subject to fair procedures for non-compliance with the benchmarks. Although AE self-monitoring and reporting to the OTF are new concepts, the overall peer review process should not have significant changes as many of the benchmarks have always been expected and implied. Therefore, AEs are expected to follow peer review Standards and guidance and will be held accountable for non-compliance.

During the pilot, the OTF will monitor benchmarks and reporting requirements to determine if modifications are needed, including the frequency and timing of reporting. The OTF will also evaluate the benchmark measurements to make sure they are appropriate and achievable.

45

Exhibit 1

Administering Entities Approved to Administer the 2017 Program

14

Administering Entity Licensing Jurisdiction(s) Alabama Society of CPAs Alabama Arkansas Society of CPAs Arkansas California Society of CPAs California, Arizona, Alaska Colorado Society of CPAs Colorado, New Mexico Connecticut Society of CPAs Connecticut Florida Institute of CPAs Florida Georgia Society of CPAs Georgia Hawaii Society of CPAs Hawaii Idaho Society of CPAs Idaho

Illinois CPA Society Illinois, Iowa, Kentucky,1 South Carolina, West Virginia,2 and Wisconsin3

Indiana CPA Society Indiana Kansas Society of CPAs Kansas Society of Louisiana CPAs Louisiana Maryland Association of CPAs Maryland Massachusetts Society of CPAs Massachusetts, New Hampshire Michigan Association of CPAs Michigan Minnesota Society of CPAs Minnesota Mississippi Society of CPAs Mississippi Missouri Society of CPAs Missouri Montana Society of CPAs Montana National Peer Review Committee N/A Nevada Society of CPAs Nevada, Wyoming, Nebraska, Utah New England Peer Review, Inc. Maine, Rhode Island, Vermont New Jersey Society of CPAs New Jersey New York State Society of CPAs New York North Carolina Association of CPAs North Carolina North Dakota Society of CPAs North Dakota The Ohio Society of CPAs Ohio Oklahoma Society of CPAs Oklahoma, South Dakota Oregon Society of CPAs Oregon, Guam, Northern Mariana Islands Pennsylvania Institute of CPAs Pennsylvania, Delaware, Virgin Islands Puerto Rico Society of CPAs Puerto Rico Tennessee Society of CPAs Tennessee Texas Society of CPAs Texas Virginia Society of CPAs Virginia, District of Columbia Washington Society of CPAs Washington

1 Effective September 2017. 2 Effective March 2017. 3 Effective April 2017.

46

Exhibit 2

On-Site Oversights of Administering Entities Performed by the AICPA Oversight Task Force

15

For the years 2016 and 2017, a member of the OTF performed an on-site oversight visit to each of the following AEs. As part of the oversight procedures, each AE is visited by a member of the OTF whenever deemed necessary, ordinarily, at least once every other year. The oversight results can be found on the AICPA’s website.

2016 2017

Alabama Colorado Arkansas Connecticut California Georgia Colorado Hawaii Florida Idaho Kansas Illinois

Michigan Indiana Mississippi Kentucky Missouri Louisiana Montana Maryland Nevada Massachusetts

New England Minnesota New Jersey Nevada

North Dakota North Carolina Ohio Oklahoma

Oregon Texas Pennsylvania Virginia Puerto Rico Washington Tennessee

West Virginia Wisconsin

47

http://www.aicpa.org/InterestAreas/PeerReview/Resources/Transparency/Oversight/Pages/OversightVisitResults.aspx

Exhibit 3

Observations From On-Site Oversights of Administering Entities Performed by the AICPA Oversight Task Force

16

As discussed in more detail in the “Oversight Visits of the AEs” section, each AE is visited at least every other year by an OTF member who performs various oversight procedures. At the conclusion of the visit, the OTF member issues an AICPA oversight visit report as well as an AICPA Oversight Visit Letter of Procedures and Observations, which details the oversight procedures performed, observations noted by the OTF member, and includes recommendations that may enhance the entity’s administration of the Program. The AE is required to respond to the chair of the OTF, in writing, to any findings reported in the Oversight Visit Report and Letter or, at a minimum, when there are no findings reported, an acknowledgement of the visit. The two oversight documents and the AE’s response are presented by the AICPA OTF PRB members at the next AICPA PRB meeting for acceptance. A copy of the acceptance letter, the two oversight visit letters, and the response are posted to the following Program web page: www.aicpa.org/interestareas/peerreview/resources/transparency/oversight/oversightvisitresults.html. The following represents a summary of observations made by the OTF resulting from the on-site oversight visits performed during 2016–2017. The following observations are examples and not indicative of every AE and may have been a single occurrence that has since been corrected upon notification. Administrative Procedures

• Annual POA not submitted timely • Acceptance letters not sent timely • Documents not uploaded timely to the FSBA website • Formal communications not sent to reviewed firms and peer reviewers when the RAB

has either delayed or deferred acceptance of the review • Confidentiality letters not obtained from technical reviewers • Confidentiality letters not obtained from committee members • All required materials not provided to the RAB • Materials not provided to the RAB timely • Resume verification not completed timely and not performed by an appropriate individual • Noncompliance with confidentiality requirements • Ineligible reviewer not suspended • Feedback forms not uploaded timely to central database • Noncompliance with document retention guidance • Reviews not presented to a RAB timely • Inadequate training and resources provided to administrative personnel • RAB minutes did not reflect all actions of the RAB, including issuance of reviewer

feedback or reviewer deficiency letter, or both • The appropriate letters for overdue information and documents, reviewer performance, and

other reminders not generated according to the time requirements in the administrative manual

Website

• The data maintained on the website as it relates to peer review is not current.

48

Exhibit 3, continued

Observations from On-Site Oversights of Administering Entities Performed by the AICPA Oversight Task Force

17

Working Paper Retention

• Working papers not retained and destroyed 120 days after acceptance by the peer review committee in accordance with the working paper retention policy of the administrative manual

Committee Procedures

• Reviewer feedback not issued when necessary. Also, reviewer feedback not signed by a peer review committee member

• Technical reviewers failed to address all significant issues before reviews presented to the RAB

• RAB composition failed to comply with requirements of the RAB Handbook. • Technical reviewers not evaluated annually • Internal oversight of the administration of the Program not performed timely. • Required oversights not performed timely • RABs scheduled infrequently leading to RAB meetings with a large number of reviews

presented that did not allow the RAB members to prepare for the meeting • RAB members not familiar with current guidance on material departures from

professional standards

49

Exhibit 4

Comments from RAB Observations Performed by AICPA Peer Review Program Staff

and OTF Members

18

Throughout each year, a sample of RABs is selected for observation. At least one RAB observation is performed for each AE per year. The documents provided to the RAB are reviewed (by Program staff, OTF members, or both) to increase the probability that the RAB process is operating properly and to ensure the results of reviews are being evaluated on a consistent basis within an AE in all jurisdictions. The following is a summary of recurring comments generated from the RAB observations performed by the Program staff and OTF members for 2017. The comments are intended to provide the AEs, their committees, RABs, peer reviewers, and technical reviewers with information and constructive recommendations that will increase consistency and improve the peer review process in the future. The comments vary in degree of significance and are not applicable to all the respective parties.

• Potential issue regarding auditor compliance with independence requirements of Government Auditing Standards (Yellow Book)

• Reviewers’ risk assessments were not comprehensive. Items not addressed include unique risks associated with employee benefit plan audits when the firm had multiple types.

• Firms’ response on the findings for further consideration (FFC) forms did not address all items listed

• Systemic cause missing or did not appropriately address the underlying cause of the finding on FFC forms

• Matters for further consideration forms included specific reviewer, firm, or client names • Firm representation letters not consistent with the illustration in appendix B of the

Standards • Report language was not consistent with current standards • Reviewer did not expand scope in accordance with standards and guidance • Firm letter of response and FFC responses did not appropriately address nonconforming

engagements • Reviews included on the consent agenda or otherwise accepted without presentation

and discussion did not comply with RAB Handbook guidance • Reviewer performance feedback not initially recommended when

— Reviewers did not appropriately aggregate and evaluate matters — Reviewers failed to identify nonconforming engagements — Oversight resulted in issues not previously detected by the reviewer — Reports and letters of response were not in compliance with standards

• Reviews were not consistently presented to the RAB free from open technical issues causing the RAB to spend extra time discussing, leading to deferred or delayed acceptance

• RAB members should have reviewed criteria for “delayed acceptance” and “deferral of a review” as set forth in the RAB Handbook.

• RAB members that performed or participated in a review did not recuse themselves from the meeting when their reviews were presented

• RAB members did not meet the training requirements as established in the RAB Handbook

• Technical reviewer, rather than committee member, signature on reviewer performance feedback form

• Deferral letters not sent timely or at all • All required documents not included in the RAB package

50

Exhibit 5

Material Departures From Professional Standards Identified by SMEs

19

As discussed in more detail in the “Enhanced Oversights” section, the SMEs identified a large number of material departures from professional standards that were not identified by the peer reviewers. The following is a list of departures from professional standards identified in the 2016 partial-year sample and the 2017 sample. The SMEs identified these departures from professional standards, individually or in the aggregate, as material departures from professional standards that caused the engagement to be considered nonconforming. Employee Benefit Plan Engagements

• Lack of documentation of design and implementation of internal controls, including documentation of reliance on system and organization controls report

• Failure to obtain sufficient appropriate audit evidence to provide reasonable assurance that fair value measurements (including appropriate leveling) and disclosures in the financial statements are in conformity with generally accepted accounting principles (GAAP)

• No testing of participant data and participant elections • No testing or inadequate testing of benefit payments or distributions, including inadequate

sample sizes • No testing of employee contributions. Contributions were not recalculated using approved

deferral rates to determine if the proper contribution was being withheld from the employee’s paycheck

• No testing of employee eligibility • References to all certifying companies not included in auditor’s report • No testing of vesting and forfeitures for distributions • No testing for contributions received or receivable • No documentation of consideration of material passed adjustments • Inadequate testing of timeliness of participant contributions • No documentation of how sample sizes were determined or inadequate sample sizes • No documentation of internal controls • No documentation of parties-in-interest in planning documentation • No documentation of consideration of IT controls • No documentation of specialist’s qualifications for an actuary and no documentation to

test adequacy of specialist’s work • No documentation of testing of material investments or sales transactions in a full scope

audit • Lack of verification of market values to independent published prices in a full scope audit • Reviewed firm identified errors during the audit, but the firm did not perform additional

procedures to determine the extent of the error or the effects on the financial statements • Inadequate testing of material contributions and contributions receivable • No documentation of testing of employer contributions at the participant level • No documentation or modification of the auditor’s report when contracting with an outside

CPA to perform the audit • Incorrect definition of compensation used by the plan • Lack of disclosure of significant portions of the benefit plan

51

Exhibit 5, continued

Material Departures From Professional Standards Identified by SMEs

20

Single Audit/Uniform Guidance and Government Auditing Standards Engagements

• No testing of internal controls over direct and material compliance requirements, including testing internal controls over some, but not all, direct and material compliance requirements

• No documentation or limited documentation of internal controls over compliance • No documentation of auditor analysis and judgment of which compliance requirements

were determined not direct and material • No documentation of specific procedures performed to test direct and material compliance

requirements • No documentation of how sample sizes were determined, including selecting a single

sample for multiple grants • No documentation of independence considerations, including skills, knowledge and

experience (SKE), threats to independence, and safeguards • No documentation of controls over the preparation of the schedule of expenditures of

federal awards (SEFA) • No documentation of procedures to determine whether the SEFA is fairly presented in all

material respects • No documentation of appropriateness and completeness of the SEFA • No documentation of risk assessment for Type B programs • Incorrectly identifying all programs as Type B when a Type A program was present • Failure to cluster related programs • Failure to use Part 3 of the Compliance Supplement to determine compliance

requirements • Incorrect Type B risk assessment resulting in testing of wrong Type B program • Type B threshold calculated incorrectly • Type B programs not assessed for risk

Carrying Broker-Dealer Engagements

• Lack of documentation of control testing performed over the preparation of the net capital or reserve computations

• Lack of documentation of why allowance for doubtful accounts was not necessary for customer receivables

• Lack of documentation of determination of completeness of revenue

52

Exhibit 6

Nonconforming Engagements Identified During 2016 Partial-Year Enhanced Oversights by Firm Size

21

In the 2016 partial-year enhanced oversight sample (reviews performed between August 1, 2016 and December 31, 2016), 108 reviews were selected for enhanced oversight (41 random and 67 targeted selections). The following tables detail the number of nonconforming engagements identified in relation to the number of must-select engagements performed by the firm in that category for all 108 must-select engagements selected for oversight. The random samples are not statistically valid and are not presented separately or compared to the prior baseline samples.

Overall Sample Number of Must-Select

Engagements Performed by Each

Firm Selected*


Must-Select Audit Engagements

Reviewed

Percentage of Engagements Reviewed That Were

Identified as Nonconforming 1–2 25 61 41% 3–5 7 16 44% 6–10 3 15 20% 11 or more 3 16 19% Total 38 108 35%

Employee Benefit Plan Engagements

Number of Must-Select Engagements

Performed by Each Firm Selected*



Reviewed



GAS/Uniform Guidance Engagements

Number of Must-Select Engagements

Performed by Each Firm Selected*



Reviewed



*Column represents the number of must-select engagements performed by the firm in the must-select category selected for oversight. Note: Two system and organization controls engagements and one FDICIA engagement was selected for oversight.

53

Exhibit 7

Nonconforming Engagements Identified During 2017 Enhanced Oversights by Firm Size

22

The 2017 enhanced oversight sample was divided into two samples: a random sample and a targeted sample. Eighty-seven must-select engagements were selected for oversight (54 random and 33 targeted selections). The following tables detail the number of nonconforming engagements identified in relation to the number of must-select engagements performed by the firm in that category for the 87 must-select engagements selected for oversight. The random samples are not statistically valid and are not presented separately or compared to the prior baseline samples.

Overall Sample

Number of Must-Select Engagements Performed by

Each Firm Selected*


Must-Select Audit

Engagements Reviewed

Percentage of Engagements Reviewed That Were Identified as

Nonconforming 1–2 26 46 57% 3–5 15 29 52% 6–10 1 4 25% 11 or more 1 8 13% Total 43 87 49%

Employee Benefit Plan Engagements


Each Firm Selected*


Must-Select Audit




GAS/Uniform Guidance Engagements


Each Firm Selected*


Must-Select Audit




*Column represents the number of must-select engagements performed by the firm in the must-select category selected for oversight. Note: One system and organization controls engagement and one carrying broker-dealer engagement was selected for oversight.

54

Exhibit 8

Administrative Oversights Performed by Peer Review Committees of Administering Entities

23

The AE’s peer review committee is required to establish administrative oversight procedures to provide reasonable assurance that the Program is being administered in accordance with guidance as issued by the PRB. An administrative oversight should be performed in those years when there is no AICPA oversight visit. Procedures to be performed should cover the administrative requirements of administering the Program. Each AE was requested to submit documentation indicating that an administrative oversight was performed with its POA. Comments or suggestions contained in the reports are summarized in the following list and are not indicative of every AE. They also vary in degree of significance. In addition, the OTF member reviewed the results of the administrative oversight during the oversight visit (described on pages 3–4, “Oversight Visits of the Administering Entities”) and compared the results of the administrative oversight with those noted during the OTF oversight visit to evaluate whether any matters still need improvement.

• Review committee member qualifications to ensure compliance with the RAB qualifications guidance in the RAB Handbook

• Reviews not presented timely to a RAB • Oversight requirements not completed timely • Resume verification not completed timely • Technical reviewers not evaluated annually • Ensure feedback is issued when necessary • Reviews not presented to the RAB free of open technical issues

55

Exhibit 9

Summary of Oversights Performed by Administering Entities

24

AEs are required to conduct oversight on a minimum of 2 percent of all reviews performed in a 12-month period of time. Within the 2 percent selected for oversight, the AE must evaluate at least 2 of each type of peer review. Also, at least 2 engagement oversights must be performed to include either audits of employee benefit plans subject to ERISA, engagements performed under GAGAS, audits of insured depository institutions subject to the FDICIA, or examinations of service organizations (SOC 1 engagements and SOC 2 engagements). The following shows the number of oversights performed for the 2017 oversight year.

Administering Type of Review/Oversights Entity System Engagement Total

Alabama 4 3 7 Arkansas 2 2 4 California 11 16 27 Colorado 2 3 5 Connecticut 1 1 2 Florida 6 2 8 Georgia 4 2 6 Idaho 1 1 2 Illinois 13 6 19 Indiana 2 2 4 Kansas 2 2 4 Louisiana 4 5 9 Maryland 2 3 5 Massachusetts 5 2 7 Michigan 3 3 6 Minnesota 2 2 4 Mississippi 2 2 4 Missouri 3 2 5 Montana 4 1 5 Nevada 2 4 6 New England 2 2 4 New Jersey 5 3 8 North Carolina 3 5 8 North Dakota 2 1 3 Ohio 4 2 6 Oklahoma 2 2 4 Oregon 2 2 4 Pennsylvania 4 5 9 Puerto Rico - - 2 Tennessee 2 3 5 Texas 11 11 22 Virginia 2 6 8 Washington 4 3 7 TOTAL 118 109 227

56

Exhibit 10

Summary of Reviewer Resumes Verified by Administering Entities

25

AEs are required to verify all reviewer resumes over a three-year period as long as, at a minimum; one-third are verified in year one; a total of two-thirds have been verified by year two; and 100 percent have been verified by year three. The following shows the number of reviewer resumes verified by AEs for the years 2015–2017.

Administering Entity 2015 2016 2017

Alabama 16 17 14 Arkansas 7 5 7 California 77 62 36 Colorado 14 6 15 Connecticut 5 5 6 Florida 57 27 25 Georgia 17 14 10 Hawaii 3 2 2 Idaho 5 8 4 Illinois 72 63 90 Indiana 13 15 11 Kansas - 7 5 Louisiana - 22 25 Maryland 12 10 14 Massachusetts 32 6 11 Michigan 30 23 22 Minnesota 28 7 16 Mississippi 20 5 13 Missouri 15 13 19 Montana 7 3 1 Nevada - 50 13 New England 8 6 10 New Jersey 37 30 33 New York 45 78 34 North Carolina 26 26 25 North Dakota 1 1 1 Ohio - 24 - Oklahoma 14 11 9 Oregon 13 10 8 Pennsylvania 34 43 18 Puerto Rico 13 8 - Tennessee 24 24 19 Texas 56 43 32 Virginia 17 11 18 Washington 17 12 11 Totals 735 697 577

57

Appendix 1

History of Peer Review at the AICPA

26

A system of internal inspection was first used regularly in the early 1960s, when a number of large firms used it to monitor their accounting and auditing practices and to make certain that their different offices maintained consistent standards. Firm-on-firm peer review emerged in the 1970s. No real uniformity to the process existed until 1977, when the AICPA’s Governing Council (council) established the Division for CPA Firms to provide a system of self-regulation for its member firms. Two voluntary membership sections within the Division for CPA Firms were created—the SEC Practice Section (SECPS) and the Private Companies Practice Section (PCPS). One of the most important membership requirements common to both sections was that once every three years, member firms were required to have a peer review of their accounting and auditing practices to monitor adherence to professional standards. The requirements also mandated that the results of peer review information be made available in a public file. Each section formed an executive committee to administer its policies, procedures, and activities as well as a peer review committee to create standards for performing, reporting, and administering peer reviews. AICPA members voted overwhelmingly to adopt mandatory peer review, effective in January 1988, and the AICPA Quality Review Program was created. Firms could enroll in the newly created AICPA Quality Review Program or become a member of the Division for CPA Firms and undergo an SECPS or PCPS peer review. Firms enrolling in the AICPA Quality Review Program that had audit clients would undergo on-site peer reviews to evaluate the firm’s system of quality control, which included a review of selected accounting and auditing engagements. Firms without audit clients that only performed engagements under the attestation standards or accounting and review services standards would undergo off-site peer reviews, which also included a review of selected engagements to determine if they were compliant with professional standards. From its inception, the peer review program has been designed to be educational and remedial in nature. Deficiencies identified within firms through this process are then corrected. For firms that perform audits and certain other engagements, the peer review is accomplished through procedures that provide the peer reviewer with a reasonable basis for expressing an opinion on whether the reviewed firm’s system of quality control for its accounting and auditing practice has been appropriately designed and whether the firm is complying with that system. In 1990, a new amendment to the AICPA bylaws mandated that AICPA members who practice public accounting with firms that audit one or more SEC clients must be members of the SECPS. In 1994, council approved a combination of the PCPS Peer Review Program and the AICPA Quality Review Program under the Program governed by the PRB, which became effective in 1995. Thereafter, because of this vote, the PCPS no longer had a peer review program. The Sarbanes-Oxley Act of 2002 established the Public Company Accounting Oversight Board (PCAOB) as a private sector regulatory entity to replace the accounting profession’s self-regulatory structure as it relates to public company audits. One of the PCAOB’s primary activities is the operation of an inspection program that periodically evaluates registered firms’ SEC issuer audit practices.

58

Appendix 1, continued

History of Peer Review at the AICPA

27

As a result, effective January 1, 2004, the SECPS was restructured and renamed the AICPA Center for Public Company Audit Firms (CPCAF). The CPCAF Peer Review Program (CPCAF PRP) became the successor to the SECPS Peer Review Program (SECPS PRP), with the objective of administering a peer review program that evaluates and reports on the non-SEC issuer accounting and auditing practices of firms that are registered with and inspected by the PCAOB. Because many SBAs and other governmental agencies require peer review of a firm’s entire auditing and accounting practice, the CPCAF PRP provided the mechanism (along with the PCAOB inspection process) to allow member firms to meet their SBA licensing and other state and federal governmental agency peer review requirements. Because both programs (AICPA and CPCAF PRPs) were only peer reviewing non-SEC issuer practices, the PRB determined that the programs could be merged and have one set of peer review standards for all firms subject to peer review. In October 2007, the PRB approved the revised Standards effective for peer reviews commencing on or after January 1, 2009. This coincided with the official merger of the programs, at which time the CPCAF PRP was discontinued, and the Program became the single program for all AICPA firms subject to peer review. Upon the discontinuance of the CPCAF PRP, the activities of the former program were succeeded by the NPRC, a committee of the AICPA PRB. In the 30 years since peer review became mandatory for AICPA membership, 53 SBAs have adopted peer review requirements, and many require their licensees to submit certain peer review documents as a condition of licensure. In order to assist firms in complying with SBA peer review document submission requirements, the AICPA created facilitated state board access (FSBA). FSBA allows firms to give permission to the AICPA or their AEs to provide access to the firms’ documents (listed in the following paragraph) to SBAs through a state-board-only-access website. Permission is granted through various opt-out and opt-in procedures. Some SBAs now require their licensees to participate in FSBA, whereas others recognize it as an acceptable process to meet the peer review document submission requirements. The FSBA documents typically include the following:4

• Peer review reports • Letters of response (if applicable) • Acceptance letters • Letters signed by the reviewed firm indicating that the peer review documents have been

accepted, with the understanding that the reviewed firm agrees to take certain actions (if applicable)

• Letters notifying the reviewed firm that required actions have been completed (if applicable)

4 As of February 2015, a firm’s current and prior peer review documents are available via facilitated state board access (FSBA). The documents are available if the state participated in FSBA for both review periods, and the firm did not opt out of FSBA for either review.

59

Appendix 2

AICPA Peer Review Program Overview

28

AICPA bylaws require that members engaged in the practice of public accounting be with a firm that is enrolled in an approved practice-monitoring program or, if practicing in firms that are not eligible to enroll, the members themselves are enrolled in such a program if the services performed by such a firm or individual are within the scope of the AICPA’s practice monitoring standards, and the firm or individual issues reports purporting to be in accordance with AICPA professional standards. Firms enrolled in the Program are required to have a peer review of their accounting and auditing practice once every three years, not subject to PCAOB permanent inspection, covering a one-year period. The peer review is conducted by an independent evaluator known as a peer reviewer. The AICPA oversees the Program, and the review is administered by an entity approved by the AICPA to perform that role. An accounting and auditing practice, as defined by the Standards, is “all engagements covered by Statements on Auditing Standards (SASs); Statements on Standards for Accounting and Review Services (SSARSs); Statements on Standards for Attestation Engagements (SSAEs); Government Auditing Standards (the Yellow Book) issued by the U.S. Government Accountability Office (GAO); and engagements performed under Public Company Oversight Board (PCAOB) standards.”

The following summarizes the different peer review types, objectives, and reporting requirements as defined under the Standards. There are two types of peer reviews: system reviews and engagement reviews. System reviews: System reviews are for firms that perform engagements under the SASs or Government Auditing Standards, examinations under the SSAEs, or engagements under PCAOB standards. In addition, agreed-upon procedures, reviews, compilations, and preparation engagements are also included in the scope of the peer review. The peer reviewer’s objective is to determine whether the firm’s system of quality control for its auditing and accounting practice is designed and complied with to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards, including Statement on Quality Control Standards (SQCS) No. 8, A Firm's System of Quality Control (Redrafted) (QC sec. 10)5, in all material respects. The peer review report rating may be pass (firm’s system of quality control is adequately designed and firm has complied with its system of quality control); pass with deficiency(ies) (firm’s system of quality control has been suitably designed and complied with to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects with the exception of deficiency[ies] described in the report); or fail (firm’s system of quality control is not adequately designed to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects). Engagement reviews: Engagement reviews are available only to firms that do not perform engagements under the SASs, Government Auditing Standards, examinations under the SSAEs, or engagements performed under PCAOB standards. The peer reviewer’s objective is to evaluate whether engagements submitted for review are performed and reported on in conformity with

5 QC section 10 can be found in AICPA Professional Standards.

60

Appendix 2, continued

AICPA Peer Review Program Overview

29

applicable professional standards in all material respects. The peer review report may be a rating of pass when the reviewer concludes that nothing came to his or her attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects. A rating of pass with deficiency(ies) is issued when the reviewer concludes that at least one, but not all, the engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. A report with a peer review rating of fail is issued when the reviewer concludes that all engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. Administering Entities Each state CPA society annually elects the level of involvement that it desires in the administration of the Program. The three options are (1) self-administer; (2) arrange for another state CPA society or group of state societies to administer the Program for enrolled firms whose main offices are located in that state; or (3) ask the AICPA to request another state CPA society to administer the Program for enrolled firms whose main offices are located in that state. The state CPA societies that choose the first option agree to administer the Program in compliance with the Standards and related guidance materials issued by the PRB. The PRB approved 39 state CPA societies, groups of state societies, or specific-purpose committees, known as AEs, to administer the Program in 2017. See exhibit 1. Each AE is required to establish a peer review committee that is responsible for administration, acceptance, and oversight of the Program. In order to receive approval to administer the Program, AEs must agree to perform oversight procedures annually. The results of their oversight procedures are submitted as part of the annual POA. The annual POA is the AE’s request to administer the Program and is reviewed and approved by the OTF. AEs may also elect to use the Standards and administer a PRP for non-AICPA firms and individuals. Non-AICPA firms and individuals are enrolled in the state CPA society PRPs and these reviews, although very similar to reviews administered by the Program, are not considered as being performed under the auspices of the Program. The reviews are not oversighted by the AICPA PRB; therefore, this report does not include information or oversight procedures performed by the AEs on their PRPs of non-AICPA firms and individuals.

61

Glossary

30

Term Definition AICPA Peer Review Board

Functions as the senior technical committee governing the Program and is responsible for overseeing the entire peer review process.

AICPA Peer Review Program Manual

The publication that includes the revised AICPA Standards for Performing and Reporting on Peer Reviews (Standards) and interpretations to the revised Standards and other guidance that is used in administering, performing, and reporting on peer reviews.

AICPA Peer Review Program Oversight Handbook

The handbook that includes the objectives and requirements of the AICPA PRB and the AE oversight process for the Program.

AICPA Peer Review Program Report Acceptance Body Handbook

The handbook that includes guidelines for the formation, qualifications, and responsibilities of AE peer review committees, report acceptance bodies, and technical reviewers. The handbook also provides guidance in carrying out those responsibilities.

Program Administrative Manual

The publication that includes guidance used by the AICPA PRB, approved state CPA societies, or other entities in the administration of the Program.

Administering entity A state CPA society, group of state CPA societies, or other entity

annually approved by the PRB to administer the Program in compliance with the Standards and related guidance materials issued by the PRB.

Agreed upon procedures

Specific procedures agreed to by a CPA, a client, and (usually) a specified third party. The report states what was done and what was found. Additionally, the use of the report is restricted to only those parties who agreed to the procedures.

Attest engagement Provide users of information, generally third parties, with an opinion,

conclusion, or findings regarding the reliability of subject matter or an assertion about the subject matter as measured against suitable and available criteria.

Audit Provide financial statement users with an opinion by the auditor on

whether the financial statements are presented fairly, in all material respects, in accordance with an applicable financial reporting framework.

Compilation Applying accounting and financial reporting expertise to assist management in the presentation of financial statements without undertaking to obtain or provide any assurance that there are no material modifications that should be made to the financial statements in order for them to be in accordance with the applicable financial reporting framework.

62

Glossary, continued

31

Term Definition Employee Retirement Income Security Act of 1974

The Employee Retirement Income Security Act of 1974 (ERISA) is a federal law that sets minimum standards for pension plans in private industry.

FDICIA Federal law enacted in 1991 to address the thrift industry crisis. The

Federal Deposit Insurance Corporation Improvement Act (FDICIA) recapitalized the Bank Insurance Fund of the Federal Deposit Insurance Corporation (FDIC), expanded the authority of banking regulators to seize undercapitalized banks, and expanded consumer protections available to banking customers.

Engagement review Enhancing Audit Quality initiative

A type of peer review for firms that do not perform audits or certain SSAE engagements that focuses on work performed and reports and financial statements issued on particular engagements (reviews or compilations). The Enhancing Audit Quality (EAQ) initiative is the AICPA’s commitment to providing the resources and tools, as well as standards, monitoring, and enforcement, necessary to move the profession further on its journey toward greater audit quality.

Financial statements A presentation of financial data, including accompanying notes, if any,

intended to communicate an entity’s economic resources or obligations, or both, at a point in time or the changes therein for a period of time, in accordance with GAAP, a comprehensive basis of accounting other than generally accepted accounting principles, or a special purpose framework.

Finding for further consideration (FFC)

A finding is one or more matters that the reviewer concludes does not rise to the level of a deficiency or significant deficiency and is documented on a finding for further consideration (FFC) form.

Firm A form of organization permitted by law or regulation whose

characteristics conform to resolutions of the Council of the AICPA that is engaged in the practice of public accounting.

Hearing When a reviewed firm refuses to cooperate, fails to correct material

deficiencies, or is found to be so seriously deficient in its performance that education and remedial corrective actions are not adequate, the PRB may decide, pursuant to fair procedures that it has established, to appoint a hearing panel to consider whether the firm’s enrollment in the Program should be terminated or whether some other action should be taken.

Implementation plan An implementation plan is a course of action that a reviewed firm has

agreed to take in response to findings for further consideration. A RAB may require an implementation plan when the responses to a firm’s FFC(s) are not comprehensive, genuine, and feasible.

63

Glossary, continued

32

Term Definition Licensing jurisdiction For purposes of this report, licensing jurisdiction means any state or

commonwealth of the United States, the District of Columbia, Guam, the Northern Mariana Islands, Puerto Rico, or the Virgin Islands.

Matter for further consideration

A matter is noted as a result of evaluating whether an engagement submitted for review was performed or reported on, or both, in conformity with applicable professional standards in all material respects. Matters are typically one or more “No” answers to questions in peer review questionnaires(s). A matter is documented on a matter for further consideration (MFC) form.

Other comprehensive basis of reporting

Consistent accounting basis other than GAAP used for financial reporting.

Oversight Task Force Appointed by the PRB to oversee the administration of the Program and make

recommendations regarding the PRB oversight procedures. Peer Review Committee

An authoritative body established by an AE to oversee the administration, acceptance, and completion of the peer reviews administered and performed in the licensing jurisdiction(s) it has agreed to administer.

Plan of administration (POA)

A document that state CPA societies complete annually to elect the level of involvement they desire in the administration of the Program.

Practice Monitoring Program

A program to monitor the quality of financial reporting of a firm or individual engaged in the practice of public accounting.

Preparation engagement

An engagement to prepare financial statements pursuant to a specified financial reporting framework.

PRIMA System An online system that is accessed to carry out the Program administrative functions.

PRISM System An online system that is accessed to carry out the Program administrative

functions. Report Acceptance Body

A committee or committees appointed by an AE for the purpose of considering the results of peer reviews and ensuring that the requirements of the Program are being complied with.

Review Obtain limited assurance as a basis for reporting whether the accountant is aware of any material modifications that should be made to the financial statements for them to be in accordance with the applicable financial reporting framework, primarily through the performance of inquiry and analytical procedures.

64

Glossary, continued

33

Reviewer feedback form

A form used to document a peer reviewer's performance on individual reviews and give constructive feedback.

Reviewer resume A document residing in PRIMA and required to be updated annually by all

active peer reviewers, which is used by AEs to determine if individuals meet the qualifications for service as reviewers as set forth in the Standards.

Scheduling status report

A report that provides key information on peer reviews such as firm name, due date, review number, type, status, and the date that background information was received.

Special purpose framework State board of accountancy

A financial reporting framework, other than GAAP, that is one of the following bases of accounting: cash basis, tax basis, regulatory basis, contractual basis, or another basis. An independent state governmental agency that licenses and regulates CPAs.

State CPA society Professional organization for CPAs providing a wide range of member benefits.

Summary review memorandum

A document used by peer reviewers to document (1) the planning of the review, (2) the scope of the work performed, (3) the findings and conclusions supporting the report, and (4) the comments communicated to senior management of the reviewed firm that were not deemed of sufficient significance to include in an FFC form.

System of quality control

A process to provide the firm with reasonable assurance that its personnel will comply with applicable professional standards and the firm’s standards of quality.

System review A type of peer review for firms that have an accounting and auditing practice. The peer reviewer’s objective is to determine whether the system of quality control for performing and reporting on accounting and auditing engagements is designed to ensure conformity with professional standards and whether the firm is complying with its system appropriately.

Technical reviewer Individual(s) at the AE whose role is to provide technical assistance to the

RAB and the Peer Review Committee in carrying out their responsibilities.

Territory A territory of the United States is a specific area under the jurisdiction of the United States and, for purposes of this report, includes Guam, the District of Columbia, the Northern Mariana Islands, Puerto Rico, and the Virgin Islands.

65

http://en.wikipedia.org/wiki/United_States

1

Agenda Item 1.10B

Informational Update: Compliance/Firm Noncooperation

Why is this on the Agenda? This is an informational item to keep the Peer Review Board (PRB) members informed about firm noncooperation activities.

Firm Noncooperation • Firms whose enrollment will be dropped from AICPA Peer Review Program (AICPA PRP)

are sent to PRB members for negative approval and subsequently reported in PRB open session materials

• Drops and terminations are reported in monthly communication to state boards of accountancy and (since January 2018) available on Extranet for administering entities (AEs).

• AICPA Peer Review Program Firm Terminations are published on the AICPA.org website for the public and included in the PRB open session materials

• Below is a summary of firm terminations over the past several years

Firm terminations Year #

2015 22 2016 40 2017 18 2018 (thru 10/2) 31 Total 111

• Reflects hearing panel decisions to terminate, including those within their available

appeal period. • Does not reflect later decisions by an appeal mechanism to reverse or modify

those decisions. • Does not reflect cases that are mediated or the underlying cause is resolved

(stopped hearings). Consecutive Non-Pass Peer Reviews AICPA staff actions taken or planned since last reporting in August 2018:

• Completed analysis and provided information and education for AEs (administrators, technical reviewers, and peer review committees) to consider and evaluate.

o Prioritization of 30 firms that may be currently eligible for referral for noncooperation for failure to improve quality.

o Approximately 170 other firms were provided to AEs for future potential referrals; these were firms with first non-pass report was accepted prior to January 1, 2015 (previous guidance allowed 3 non-pass reports before referral consideration).

• Technical reviewers and committees increased attention on consecutive non-pass reviews during the acceptance process due to the recent change in the technical reviewer’s checklist.

66

https://www.aicpa.org/forthepublic/prfirmterm.html

2

Completeness Activities Objective: Research publicly available data to verify that all firms that should be enrolled in peer review are enrolled and to verify that all engagements that are within peer review scope are included in the population subject to peer review. Firms without AICPA members are also included in the scope of these ongoing activities. Most recent project in progress seeks to identify firms performing Employee Benefit Plan (EBP) audits via the Department of Labor (DOL) database and assess whether the firms are in compliance with peer review requirements. Research based on filings for EBP audits with plan years through 12/31/16 indicates the following as of October 2018:

Classification/Status # of Firms (rounded) % of Total

Closed 4900 94%Non-compliance/in progress: Not Enrolled 200 4% Enrolled, omitted EBP 100 2%Total unique firms in population 5200 100%

o Closed

Firms were either in compliance, there is no avenue for recourse (firm sold/merged, etc.), or situation otherwise resolved

o Not enrolled (potentially non-compliant) Approximately 200 firms were originally not enrolled prior to staff enrollment

verification inquires and requests to enroll if required • Resulted in approximately 70 firms enrolling thus far; staff will monitor for continued

peer review compliance • Firms that did not comply with enrollment request are referred to appropriate

regulatory body (Ethics or state board of accountancy); approximately 90 thus far referred to Ethics to further consider

• Awaiting final resolution for approximately 40 firms o Enrolled, omitted EBP

Approximately 100 firms were enrolled but appear to have omitted EBP from most recently accepted review • Resulted in initiation of recall of approximately 50 peer reviews thus far

(subsequent noncooperation hearings expected in early 2019) • Resulted in more timely remediation of approximately 40 firms; omission will be

addressed in current or upcoming review if already scheduled Reviewer should consider the implications of the omission matter, but a

related peer review report deficiency is not expected unless there is a systemic issue in the quality control system

• Awaiting final resolution for approximately 10 firms o Overall compliance rate for unique firms in the DOL database is 94%

67

Agenda Item 1.10C

1

Firms Dropped from the AICPA Peer Review Program for Non-Cooperation

between July 17, 2018 and September 25, 2018

Firm Number Firm Name State Drop Date Drop Reason 900010059232 Weinberger, Struett, Inc. CA 8/26/2018 PR Info Not Received

900255187384 Cynthia A. Greene CT 8/26/2018 PR Info Not Received

900010093186 Gidney and Company, CPA's FL 8/27/2018 Society Admin Fee Not Paid

900011585650 Joan E. Jones, CPA NC 8/26/2018 PR Info Not Received

900011472510 John F. Duffy, Public Accountant NJ 8/26/2018 PR Info Not Received

900006204259 MS Group CPA LLC NJ 8/26/2018 PR Info Not Received

900011610909 Dennis B. Williams, CPA PC NM 8/26/2018 PR Info Not Received

900010148953 Mayor CPA Group LLC OH 8/27/2018 PR Info Not Received

900004550491 LJ Evans & Co. OH 8/27/2018 PR Info Not Received

900255190521 Bales CPA & Consulting, PLLC TN 8/27/2018 Society Admin Fee Not Paid

900010132885 Terri L. Vedders, CPA WA 8/27/2018 PR Info Not Received

68

Agenda Item 1.10C

2

Firms Whose Enrollment Was Terminated from the AICPA Peer Review Program since Reporting at the August 2018 Meeting

Failure to complete a corrective action:

The AICPA Peer Review Program terminated the following firms’ enrollment in the AICPA Peer Review Program for failure to cooperate. The firms did not complete corrective actions designed to remediate deficiencies identified in the firm’s most recent peer review.

Brown & Co., P.C. – Oak Park, MI James C. Thompson & Co. – Saint Louis, MO Kent E. Reeves, CPA – Fairfield, IL W. Fred Chapman – Atlantic Beach, NC

Firm terminations are also published on our website at: https://www.aicpa.org/forthepublic/prfirmterm/2018peerreviewfirmterminations.html

69

Exhibit A

PRP SECTION 1000

MAPPING DOCUMENT

This mapping document demonstrates how the material in extant PRP section 1000 has been reflected in the clarified PR-C.

PRP Section 1000 PR-C Explanation

.08 The majority of the procedures in a System Review should be performed at the reviewed firm’s office (see interpretations). Engagement Reviews are normally performed at a location other than the reviewed firm’s office.

.08 The majority of the procedures in a System Review should be performed at the reviewed firm’s office (see interpretations). 220.A2 Engagement Reviews are normally performed at a location other than the reviewed firm’s office.

Performing Engagement Reviews

.102 The objective of an Engagement Review is to evaluate whether engagements submitted for review are performed and reported on in conformity with applicable professional standards in all material respects. An Engagement Review consists of reading the financial statements or information submitted by the reviewed firm and the accountant’s report thereon, together with certain background information and representations and the applicable documentation required by professional standards.

220.04102 In performing The objective of an Engagement Review, the objectives of the reviewer are is to

a. evaluate whether engagements submitted for review are performed and reported on in conformity with applicable professional standards in all material respects.

An Engagement Review consists of reading the financial statements or information submitted by the reviewed firm

Removed second part b/c it is covered in the evaluation section

70



and the accountant’s report thereon, together with certain background information and representations and the applicable documentation required by professional standards.

.103 Engagement Reviews are not available to firms that perform engagements under the SASs, engagements under Government Auditing Standards, examinations under the SSAEs, or engagements performed under PCAOB standards. However, firms eligible to have an Engagement Review may elect to have a System Review (see interpretations).

220..02103 Engagement Reviews are not available to firms that perform engagements under the SSARSSASs, and engagements under Government Auditing Standards, the SSAEs other than examinations under the SSAEs, or engagements performed under PCAOB standards. However,

220.A1 Ffirms eligible to have an Engagement Review may elect to have a System Review (see interpretations).

Changed to what they do cover.

Basic Requirements

.104 The criteria for selecting the peer review year-end and the period to be covered by an Engagement Review are the same as those for a System Review (see paragraphs .13–.19). Engagements subject to review ordinarily should be those with periods ending during the year under review, except for

Basic Requirements

.104 The criteria for selecting the peer review year-end and the period to be covered by an Engagement Review are the same as those for a System Review (see paragraphs .13–.19). Engagements subject to review ordinarily should be

Removed the first sentence b/c they are duplicative.

71



financial forecasts or projections and agreed upon procedures. Financial forecasts or projections and agreed upon procedures with report dates during the year under review would be subject to selection. The reviewed firm should provide summarized information showing the number of its compilation, review and preparation engagements performed under SSARSs and engagements performed under the SSAEs, classified into industry categories. That information should be provided for each partner, or individual if not a partner, of the firm who is responsible for the issuance of reports on such engagements or the issuance of prepared financial statements with or without disclaimer reports. On the basis of that information, the review captain or the administering entity ordinarily should select the types of engagements to be submitted for review, in accordance with the following guidelines (see interpretations):

a. One engagement should be selected from each of the following areas of service performed by the firm:


2. Compilation of financial statements, with disclosures (performed under SSARSs)

those with periods ending during the year under review, except for financial forecasts or projections and agreed upon procedures. Financial forecasts or projections and agreed upon procedures with report dates during the year under review would be subject to selection.

220.06 The review captain should obtain from the reviewed firm; should provide summarized information showing

a. the number of its compilation, review and preparation engagements performed under SSARSs and engagements performed under the SSAEsby level of service and, classified into industry categories. That information should be provided for each partner, or individual if not a partner, of the firm who is responsible for the issuance of reports on such engagements or the issuance of prepared financial statements with or without disclaimer reports. On the basis of that information, t

b. the required representations from the firm’s management (Ref..);

c. the firm’s prior;

Moved requirements in .106 into PR-C 220.06. they should all be part of planning. (Make sure the definition of commencement considers this) Also, need to reference where the required representations are located.

72





b. One engagement should be selected from each partner, or individual of the firm if not a partner, responsible for the issuance of reports listed in item a.

c. Selection of preparation engagements should only be made in the following instances:

1. One preparation engagement with disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item a or when the firm’s only engagements with disclosures are preparation engagements.

2. One preparation engagement that omits substantially all disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in

1. peer review report; 2. letter of response (if

applicable); 3. letter of acceptance; 4. FFC forms (if applicable);

and 5. Representation letter

220.07 The review captain or the administering entity ordinarily should select the types of engagements to be submitted for review, in accordance with the following guidelines (see interpretations):

a. One engagement should be selected from each of the following areas of service performed by the firm:


2. Compilation of financial statements, with disclosures

73



item a or when the firm’s only omit disclosure engagements are preparation engagements.

3. One preparation engagement should be selected if needed to meet the requirement in item d.

d. Ordinarily, at least two engagements should be selected for review.

(performed under SSARSs)





1. One preparation engagement with disclosures

74



(performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item a or when the firm’s only engagements with disclosures are preparation engagements.

2. One preparation engagement that omits substantially all disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item a or when the firm’s only omit disclosure engagements are

75



preparation engagements.


d. Ordinarily, aAt least two engagements, unless only one is performed. should be selected for review.

220.08 Preparation engagements should only be selected in the following instances:

a. One preparation engagement with disclosures (performed under SSARSs) should be selected when performed by an individual in the firm who does not perform any engagements included in item .07a or when the firm’s only engagements with disclosures are preparation engagements.

b. One preparation engagement that omits substantially all disclosures (performed under SSARSs)

76



should be selected when performed by an individual in the firm who does not perform any engagements included in item .07a or when the firm’s only omit disclosure engagements are preparation engagements.

c. One preparation engagement should be selected if needed to meet the requirement in item d.

.105 The preceding criteria are not mutually exclusive. The objective is to ensure that one engagement is selected for each partner and one engagement is selected from each of the areas of service performed by the firm listed in item a in the previous list. Therefore, one of every type of engagement that a partner, or individual if not a partner, responsible for the issuance of the reports listed in item a in the previous list performs does not have to be reviewed as long as, for the firm taken as a whole, all types of engagements noted in item a in the previous list performed by the firm are covered.

220.A3105 The engagement selectionpreceding criteria requirements are not mutually exclusive. The objective of those requirements is to ensure thatselect one engagement is selected for each partner and one engagement is selected from each of the areaslevel of service performed by the firm listed in item.05 a in the previous list. Therefore, one of every type of engagement that a partner, or individual if not a partner, responsible for the issuance of the reports listed in item a in the previous list performs does not

77



have to be reviewed as long as, for the firm taken as a whole, all types of engagements noted in item a in the previous list performed by the firm are covered.

.106 The review captain should obtain the required representations from the firm (see paragraph .05f) for the current review. The review captain should also obtain the firm’s prior peer review report, letter of response, if applicable, letter accepting those documents, FFC forms, if applicable, and the firm’s representation letter from the firm or administering entity.

Moved to PR-C 220.06 Combined most of this paragraph with .104

.107 For each engagement selected for review, the reviewed firm should submit the appropriate financial statements or information and the accountant’s report, masking client identity if it desires, along with specified background information, representations about each engagement and the firm’s documentation required by applicable professional standards for each of these engagements. There is a presumption that all engagements otherwise subject to the peer review will be included in the scope of the review. However, in the rare situations when exclusions or other limitations on the scope of the review are being contemplated, a review captain should

Move to section 320 for firms

78



carefully consider the implications of such exclusion. This includes communicating with the firm and the administering entity the effect on the review and on the ability of the review captain to issue a peer review report.

.108 The evaluation of each engagement submitted for review includes the following:

a. Consideration of the financial statements or information and the related accountant’s report on the compilation, review and preparation engagements performed under SSARS and engagements performed under SSAEs (see interpretations)

b. Consideration of the documentation on the engagements performed via reviewing background and engagement profile information, representations made by the firm, and inquiries


220.10.108 The reviewer should evaluate each engagement submitted for review. The evaluation of each engagement submitted for reviewshould includes the following:

a. Consideration of the financial statements or information and the related accountant’s report on the compilation, review and preparation engagements performed under SSARS and engagements performed under SSAEs (see interpretations)

b. Consideration of the documentation on the engagements performed via reviewing background and engagement profile information,

a. should probably be rewritten since there isn’t a report on a prep. Also, consider if we need a requirement to complete the checklist to meet the evaluation criteria.

79



representations made by the firm, and inquiries


.109 An Engagement Review does not include a review of other documentation prepared on the engagements submitted for review (other than the documentation referred to in paragraphs .107–.108), tests of the firm’s administrative or personnel files, interviews of selected firm personnel, or other procedures performed in a System Review (see interpretations). Accordingly, an Engagement Review does not provide the review captain with a basis for expressing any form of assurance on the firm’s system of quality control for its accounting practice. The review captain’s report does indicate, however, whether anything came to the review captain’s attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects (see interpretations). The review captain should promptly inform the firm when an engagement is not performed or reported on in conformity with applicable professional standards and remind the firm of its obligation under

.109220.A18 An Engagement Review does not include a review of other documentation prepared on the engagements submitted for review (other than the documentation referred to in paragraphs .107–.108), tests of the firm’s administrative or personnel files, interviews of selected firm personnel, or other procedures performed in a System Review (see interpretations). Accordingly, an Engagement Review does not provide the review captain with a basis for expressing any form of assurance on the firm’s system of quality control for its accounting practice.

220.27 The review captain’s report doesshould indicate, however, whether anything came to the

80



professional standards to take appropriate actions (see interpretations).

review captain’s attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects (see interpretations).

220.18 The review captain should promptly inform the firm on an MFC when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its obligation under professional standards to take appropriate actions (see interpretations).

Identifying Matters, Findings, Deficiencies, and Significant Deficiencies

.110 Determining the relative importance of matters noted during the peer review, individually or combined with others, is a matter of professional judgment. Careful consideration is required in forming conclusions. The descriptions that follow,

Identifying Matters, Findings, Deficiencies, and Significant Deficiencies

220.12110 The reviewer should D determineing the relative importance of matters noted during the peer review,

This section needs to be reworked. Consider how to communicate the information in a concise fashion.

81



used in conjunction with practice aids (MFC, DMFC, and FFC forms) to document these items, are intended to assist in determining the nature of the peer review report to issue:

a. A matter is noted as a result of evaluating whether an engagement submitted for review was performed or reported on in conformity with applicable professional standards. The evaluation includes reviewing the financial statements or information, the related accountant’s reports, and the adequacy of procedures performed, including related documentation. Matters are typically one or more “No” answers to questions in peer review questionnaire(s). A matter is documented on a Matter for Further Consideration (MFC) form.

b. A finding is one or more matters that the review captain has concluded result in financial statements or information, the related accountant’s reports submitted for review, or the procedures performed, including related documentation, not being performed or reported on in conformity with the requirements of applicable professional standards. A review captain will conclude whether one or more findings are a deficiency or significant deficiency. If the review captain concludes that no finding, individually or combined with others, rises

individually and in the aggregate.or combined with others, is a matter of professional judgment. Careful consideration is required in forming conclusions. The descriptions that follow, used in conjunction with practice aids (MFC, DMFC, and FFC forms) to document these items,

220.25 To determine the type of report to issue, the review captain should use the results of the evaluation of engagements reviewed are intended to assist in determining the nature of the peer review report to issue:

a.

220.13 A reviewer should document Aa matter is noted as a result of evaluating whether an engagement submitted for review was performed or reported on in conformity with applicable professional standards. The evaluation includes reviewing the financial statements or information, the related accountant’s reports, and the adequacy of procedures performed, including

Highlights have been added to definitions (220.04). Consider if selected or submitted should be used.

82



to the level of deficiency or significant deficiency, a report rating of pass is appropriate. A finding not rising to the level of a deficiency or significant deficiency is documented on a Finding for Further Consideration (FFC) form.

c. A deficiency is one or more findings that the review captain concludes are material to the understanding of the financial statements or information or related accountant’s reports or that represent omission of a critical procedure, including documentation, required by applicable professional standards. When a deficiency is noted, the review captain concludes that at least one but not all engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. When the review captain concludes that deficiencies are not evident on all of the engagements submitted for review, such deficiencies are communicated in a report with a peer review rating of pass with deficiencies.

d. A significant deficiency exists when the review captain concludes that deficiencies are evident on all of the engagements submitted for review. When a significant deficiency is noted, the review captain concludes that all engagements submitted for

related documentation. Matters are typically one or more “No” answers to questions in peer review checklistsquestionnaire(s). A matter is documented on a Matter for Further Consideration (MFC) form when the reviewer identifies one or more “No” answers to peer review engagement checklists.

b. A finding is one or more matters that the review captain has concluded result in financial statements or information, the related accountant’s reports submitted for review, or the procedures performed, including related documentation, not being performed or reported on in conformity with the requirements of applicable professional standards.

220.14 A reviewer captain should document a finding on a Finding for Further Consideration (FFC) when the reviewer concludes the submitted engagement(s) was not performed or reported on in conformity with the requirements of the applicable standards but does not rise to the level of a deficiency or significant deficiency.will conclude whether one or more findings are a deficiency or

83



review were not performed or reported on in conformity with applicable professional standards in all material respects. Such significant deficiencies are communicated in a report with a peer review rating of fail.

significant deficiency. If the review captain concludes that no finding, individually or combined with others, rises to the level of deficiency or significant deficiency, a report rating of pass is appropriate. A finding not rising to the level of a deficiency or significant deficiency is documented on a Finding for Further Consideration (FFC) form.

220.15 A reviewer should document a deficiency in the report when the reviewer concludes at least one, but not all, engagements submitted for review were not performed or reported on in conformity with the requirements of the applicable standards in all material respects.

c. A deficiency is one or more mattersfindings that the review captain concludes are material to the understanding of the financial statements or information or related accountant’s reports or that represent omission of a critical procedure, including documentation, required by applicable professional standards. At least one, but not all, engagements submitted for review were not performed or reported on in conformity with applicable

84



professional standards in all material respects.When a deficiency is noted, the review captain concludes that at least one but not all engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. When the review captain concludes that deficiencies are not evident on all of the engagements submitted for review, such deficiencies are communicated in a report with a peer review rating of pass with deficiencies. .

d. A significant deficiency exists when the review captain concludes that deficiencies are evident on all of the engagements submitted for reviewed.

220.16 A reviewer should document a significant deficiency in the report when the reviewer concludes all engagements submitted for review were not performed or reported on in conformity with requirements of the applicable standards in all material respects.When a significant deficiency is noted, the review captain concludes that all engagements submitted for

85



review were not performed or reported on in conformity with applicable professional standards in all material respects. Such significant deficiencies are communicated in a report with a peer review rating of fail.

.111 A broad understanding of the peer review process, from the review of submitted engagements to the decision making process of determining whether an item noted during an Engagement Review is a matter, finding, deficiency, or significant deficiency, is shown in exhibit B. The exhibit also illustrates the aggregation of these items, where those items are documented in the practice aids, and how they might affect the type of report issued.

Application guidance Exhibit B

Exhibit B Application guidance

.112 As described by exhibit B in paragraph .111, depending on the resolution of a matter and the process of aggregating and evaluating peer review results, a matter may develop into a finding. Findings will also be evaluated, and after considering their nature and relative importance, including whether they are material to the understanding of the report or financial statements or represent the omission of a critical procedure

220.A6 112 As described by exhibit B in paragraph .111, dDepending on the resolution of a matter and the process of aggregating and evaluating peer review results, a matter may develop into a finding. Findings will also be evaluated, and after considering their nature and relative

86



including documentation, may not get elevated to a deficiency. Alternatively, a matter may develop into a finding and get elevated to a deficiency. That deficiency may or may not be further elevated to a significant deficiency.

importance, including whether they are material to the understanding of the report or financial statements or represent the omission of a critical procedure including documentation, may not get elevated to a deficiency. Alternatively, a matter may develop into a finding and get elevated to a deficiency. That deficiency may or may not be further elevated to a significant deficiency.

.113 A matter is documented on an MFC form. If the matter, after further evaluation, gets elevated to a finding, but not a deficiency or significant deficiency, it is documented on a FFC form. The FFC form is a standalone document that includes the reviewed firm’s response regarding actions planned or taken and the timing of those actions by the firm. MFC and FFC forms are subject to review and oversight by the administering entity, who will evaluate the reviewed firm’s FFC form responses for appropriateness and responsiveness (see paragraphs .141–.145). If the matter documented on the MFC form is instead elevated to a deficiency or significant deficiency, then it is communicated in the report itself. The firm submits a letter of response regarding actions planned or taken and the

Removed, duplicative Consider if we could put oversight in sec. 100 and state it’s applicable throughout the peer review process.

87



timing of those actions by the firm, which is also evaluated for appropriateness and responsiveness (see paragraphs .139–.140).

.114 In order to document the disposition of all the MFCs, the review captain completes a DMFC form. The DMFC form is part of the working papers and provides a trail of the disposition of the MFCs for the peer reviewer, administering entity, and individuals conducting technical reviews or oversight. All of the MFCs are identified on the DMFC form with an indication after each as to whether it was cleared, discussed with the firm, included on a specific FFC form (individually or combined with other MFCs), or included as a deficiency in a report with a peer review rating of pass with deficiencies or as a significant deficiency in a report with a peer review rating of fail.

220.17In order to document the disposition of all the MFCs, theA review captain should completes a Disposition of Matter for Further Consideration (MFC) form. The DMFC form is part of the working papers and provides a trail of the disposition of the all MFCs for the peer reviewer, administering entity, and individuals conducting technical reviews or oversight. All of the MFCs are identified on the DMFC form with an indicationng after each as to whether it was:

• cleared,

• discussed with the firm,

• included on a specific FFC form (individually or combined with other MFCs), or

88



• included as a deficiency in a report with a peer review rating of pass with deficiencies or as a significant deficiency in a report with a peer review rating of fail.

Communication Requirements for Closing Meeting and Exit Conference

.115 Prior to issuing his or her report or finalizing MFC and FFC form(s), if applicable, the review captain should communicate his or her conclusions to the firm at a closing meeting. The closing meeting is normally held via teleconference and may also be attended by representatives of the administering entity, the board, AICPA staff, or other board authorized organizations with oversight responsibilities. The review captain should discuss the following during the closing meeting:

a. Preliminary peer review results, including any matters, findings, deficiencies or significant deficiencies, and the type of report to be issued.

b. The firm’s requirement to respond to the MFC form(s), FFC form(s), or the


220.22.115 Prior to issuing thehis or her report or finalizing MFC and FFC form(s), if applicable, the review captain should communicate thehis or her conclusions to the firm at a closing meeting. The closing meeting is normally held via teleconference and may also be attended by representatives of the administering entity, the board, AICPA staff, or other board authorized organizations with oversight responsibilities. The review captain should discuss the following during the closing meeting:

a. Preliminary peer review results, including any

89



deficiency(ies) or significant deficiency(ies) included in the peer review report.

c. Other suggestions and observations for the firm to consider. For example, implications of upcoming changes in professional standards, operational or efficiency suggestions, and minor areas for improvement considerations.

An exit conference will be held after the firm has responded to the MFC form(s), FFC form(s), and deficiencies or significant deficiencies in the report and the review captain has assessed whether the responses are appropriate and has considered any additional impact to the peer review results, and is normally held via teleconference. Accordingly, except in rare circumstances that should be explained to the firm, the exit conference should be postponed if there is uncertainty about the report to be issued or the deficiencies or significant deficiencies to be included in the report. The purpose of a separate closing meeting and exit conference is to provide the firm sufficient time to determine appropriate responses to the matters, findings, deficiencies, and significant deficiencies identified and to provide the review captain with sufficient time to assess the firm’s responses prior to the report date (exit conference date). If these steps have been taken prior to the closing meeting or are not necessary, the closing meeting and exit conference may be combined. In either

matters, findings, deficiencies or significant deficiencies, and the type of report to be issued.

b. The firm’s requirement to respond to the MFC form(s), FFC form(s), or the deficiency(ies) or significant deficiency(ies) included in the peer review report.

c. The firm’s required written representations.

d.c. Other suggestions and observations for the firm to consider. For example, implications of upcoming changes in professional standards, operational or efficiency suggestions, and minor areas for improvement considerations.

220.A11 The closing meeting and exit conference are normally held via teleconference and may also be attended by representatives of the administering entity, the board,

90



circumstance, the exit conference should ordinarily be held prior to but no later than the review due date (see interpretations). The review captain should discuss the following during the exit conference:


b. Potential implications of the RAB acceptance process such as corrective actions (for deficiencies and significant deficiencies) and implementation plans (for findings) that may be imposed by the RAB, if applicable. The review captain should also discuss with the firm the implications of these steps on the acceptance and completion of the peer review and the firm’s enrollment in the program.

c. Peer review noncooperation implications of consecutive non-pass report ratings, if applicable (see interpretations).

AICPA staff, or other board authorized organizations with oversight responsibilities.

220.23 An exit conference will be held after the firm has responded to the MFC form(s), FFC form(s), and deficiencies or significant deficiencies in the report and the review captain has assessed whether the responses are appropriate and has considered any additional impact to the peer review results, and is normally held via teleconference. Accordingly, except in rare circumstances that should be explained to the firm, the exit conference should be postponed if there is uncertainty about the report to be issued or the deficiencies or significant deficiencies to be included in the report. The purpose of a separate closing meeting and exit conference is to provide the firm sufficient time to determine appropriate responses to the matters, findings, deficiencies, and significant deficiencies identified and to provide the review captain with sufficient time to assess the firm’s responses prior to the report date (exit conference date). If these steps have been taken prior to the closing meeting or are not necessary, the closing meeting and exit conference may be combined. In either circumstance, ,

91



the review captain should communicate the results to the firm at an exit conference. should ordinarily be held prior to but no later than the review due date (see interpretations). The review captain should discuss the following during the exit conference:


b. The appropriateness of the firm’s response should be discussed during the exit conference.

c. Obtain and review the firm’s representation letter

bd. Potential implications of the RAB acceptance process such as corrective actions (for deficiencies and significant

92



deficiencies) and implementation plans (for findings) that may be imposed by the RAB, if applicable. The review captain should also discuss with the firm the implications of these steps on the acceptance and completion of the peer review and the firm’s enrollment in the program.

ce. Peer review noncooperation implications of consecutive non-pass report ratings, if applicable (see interpretations).

220.24 The exit conference should be held prior to the review due date.

Addressing Disagreements Between the Reviewer and the Reviewed Firm

.116 Disagreements may arise during attempts to resolve various issues. For instance, there could be a disagreement on the appropriate approach to performing or reporting in conformity with

PR-C 100.XX

93



applicable professional standards, or the review team might not believe that the actions planned or taken by the firm, if any, are appropriate (for example, if the reviewed firm believes that it can continue to support a previously issued report and the review team continues to believe that there may be a failure to reach appropriate conclusions in the application of professional standards). Reviewers and reviewed firms should understand that professional judgment often becomes a part of the process and that each party has the right to challenge each other on an issue. Nevertheless, a disagreement during the resolution of an issue may persist in some circumstances. The reviewed firm and reviewer should consult with their administering entity and, if necessary, request that a panel of the administering entity’s peer review committee members resolve the disagreement. The panel must reach a decision to resolve the disagreement. Any of the disagreeing parties may request an appeal by writing the board and explaining why he or she believes a review of the panel’s decision is warranted. A panel formed by the board will review and consider the request and take further action pursuant to fair procedures that it has established.

Reporting on Engagement Reviews

Forming Conclusions on the Type of Report to Issue in an Engagement Review

220.A14

94



Engagement Review Report With a Peer Review Rating of Pass

.117 A report with a peer review rating of pass is issued when the reviewer concludes that nothing came to his or her attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects. There are no deficiencies or significant deficiencies that affect the nature of the report and, therefore, the report does not contain any deficiencies or significant deficiencies. In the event of a scope limitation, a report with a peer review rating of pass (with a scope limitation) is issued.

Engagement Review Report With a Peer Review Rating of Pass With Deficiencies

.118 A report with a peer review rating of pass with deficiencies is issued when at least one but not all of the engagements submitted for review contain a deficiency. In the event of a scope limitation, a report with a peer review rating of pass with deficiencies (with a scope limitation) is issued.

220.A15

Engagement Review Report With a Peer Review Rating of Fail

220.A16

95



.119 A report with a peer review rating of fail is issued when the review captain concludes that, as a result of the deficiencies described in the report, the engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects. A report with a peer review rating of fail is issued when deficiencies are evident on all of the engagements submitted for review. The review captain should not expand scope beyond the original selection of engagements in an effort to change the conclusion from a peer review rating of fail in these circumstances. In the event of a scope limitation, a report with a peer review rating of fail (with a scope limitation) is issued.

General

.120 In an Engagement Review, the review captain should furnish the reviewed firm with a written report within 30 days of the exit conference date or by the firm’s peer review due date, whichever is earlier. A report on a review performed by a firm should be issued on the letterhead of the firm performing the review. A report by a review team formed by an association of CPA firms should be issued on the letterhead of the firm of the review captain performing the review. Other reports are issued on the letterhead of the administering entity. The report in an Engagement Review ordinarily should be dated as of the date of the exit conference.

General

220.26.120 In an Engagement Review, tThe review captain should furnishprovide the reviewed firm with a written report within 30 days of the exit conference date or by the firm’s peer review due date, whichever is earlier. A report on a review performed by a firm should be issued on the letterhead of the firm performing the review. A report by a review team formed by an association of CPA firms

Highlighted and deleted sections were cut and pasted into 220.28, new report requirements paragraph

96



See interpretations for guidance on notification requirements and submission of peer review documentation to the administering entity.

should be issued on the letterhead of the firm of the review captain performing the review. Other reports are issued on the letterhead of the administering entity. The report in an Engagement Review ordinarily should be dated as of the date of the exit conference. See interpretations for guidance on notification requirements and submission of peer review documentation to the administering entity.

Illustrations of Reports in an Engagement Review

.121 The standard form for a report with a peer review rating of pass is illustrated in appendix M, “Illustration of a Report with a Peer Review Rating of Pass in an Engagement Review.” Illustrations of reports with a peer review rating of pass with deficiencies and fail are presented in appendixes N, “Illustration of a Report with a Peer Review Rating of Pass with Deficiencies in an Engagement Review,” and P, “Illustration of a Report with a Peer Review Rating of Fail in an Engagement Review,” respectively. Additional paragraphs included for scope limitations follow the illustrations for System

Application

97



Reviews with scope limitations (see appendixes D, G, and K).

.122 The written report in an Engagement Review should:

a. State at the top of the report the title “Report on the Firm’s Conformity With Professional Standards on Engagements Reviewed.”

b. Include headings for each of the following sections:

i. Firm’s Responsibility

ii. Peer Reviewer’s Responsibility

iii. Deficiency(ies) or Significant Deficiency(ies) Identified on the Firm’s Conformity With Professional Standards on Engagements Reviewed, if applicable

iv. Scope Limitation, if applicable

v. Conclusion

c. State that the review captain reviewed selected accounting engagements of the firm

220.28122 The written report in an Engagement Review should:

a. a. be dated as of the date of the exit conference

b. be issued on the letterhead of the firm performing the review 1

a.c. State at the top of the report the title “Report on the Firm’s Conformity With Professional Standards on Engagements Reviewed.”

b. Include headings for each of the following sections:

i. Firm’s Responsibility

ii. Peer Reviewer’s Responsibility

1 A report by a review team formed by an association of CPA firms should be issued on the letterhead of the firm of the review captain performing the review. Other reports are issued on the letterhead of the administering entity.

98



and include the year-end covered by the peer review.

d. State that the peer review was conducted in accordance with the Standards for Performing and Reporting on Peer Reviews established by the Peer Review Board of the American Institute of Certified Public Accountants.

e. State that the nature, objectives, scope, limitations of, and procedures performed in an Engagement Review as described in the Standards can be found on the AICPA website where the Standards are summarized.

f. State that the firm is responsible for designing a system of quality control and complying with it to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects and for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, where appropriate, and for remediating weaknesses in its system of quality control, if any.

g. State that the reviewer’s responsibility is to evaluate whether the engagements submitted

iii. Deficiency(ies) or Significant Deficiency(ies) Identified on the Firm’s Conformity With Professional Standards on Engagements Reviewed, if applicable

iv. Scope Limitation, if applicable

v. Conclusion

c. State that the review captain reviewed selected accounting engagements of the firm and include the year-end covered by the peer review.

d. State that the peer review was conducted in accordance with the Standards for Performing and Reporting on Peer Reviews established by the Peer Review Board of the American Institute of

99



for review were performed and reported on in conformity with applicable professional standards in all material respects.

h. State that an Engagement Review does not include reviewing the firm’s system of quality control and compliance therewith and, accordingly, the reviewers express no opinion or any form of assurance on that system.

i. In the event of a scope limitation, include an additional paragraph before the last paragraph that describes the relationship of the excluded engagement(s) to the firm’s practice as a whole, the highest level of service and industry concentration, if any, of the engagement(s) excluded from the potential selection, and the effect of the exclusion on the scope and results of the peer review. Tailor the conclusion, as appropriate, to address the scope limitation.

j. Identify the different peer review ratings that the firm could receive.

k. In a report with a peer review rating of pass, state:

i. That nothing came to the review captain’s attention that caused the review captain to believe that the

Certified Public Accountants.

e. State that the nature, objectives, scope, limitations of, and procedures performed in an Engagement Review as described in the Standards can be found on the AICPA website where the Standards are summarized.

f. State that the firm is responsible for designing a system of quality control and complying with it to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects and for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, where appropriate, and for

100



engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of pass.

l. In a report with a peer review rating of pass with deficiencies, fn 12 state:

i. That as a result of the deficiencies previously described, the review captain believes that at least one but not all of the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of pass with deficiencies.

remediating weaknesses in its system of quality control, if any.

g. State that the reviewer’s responsibility is to evaluate whether the engagements submitted for review were performed and reported on in conformity with applicable professional standards in all material respects.

h. State that an Engagement Review does not include reviewing the firm’s system of quality control and compliance therewith and, accordingly, the reviewers express no opinion or any form of assurance on that system.

i. In the event of a scope limitation, include an


101



m. In a report with a peer review rating of fail, state:

i. That as a result of the deficiencies previously described, the review captain believes that all the engagements submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of fail.

n. In a report with a peer review rating of pass with deficiencies or fail:

i. Include descriptions of the deficiencies or significant deficiencies (each of these should be numbered) (see interpretations).

ii. Identify any deficiencies or significant deficiencies that were also made in the report in the firm’s previous peer review. However, if the specific types of reporting, presentation, disclosure, or documentation deficiencies or significant deficiencies are not substantially the same on the current

additional paragraph before the last paragraph that describes the relationship of the excluded engagement(s) to the firm’s practice as a whole, the highest level of service and industry concentration, if any, of the engagement(s) excluded from the potential selection, and the effect of the exclusion on the scope and results of the peer review. Tailor the conclusion, as appropriate, to address the scope limitation.

j. Identify the different peer review ratings that the firm could receive. (Ref. par. .A18)

k. In a report with a peer review rating of pass, state:

i. That nothing came to the review captain’s attention that caused the

102



review as on the prior review, the deficiencies or significant deficiencies would not be considered a repeat (see interpretations).

iii. Identify the level of service for any deficiencies or significant deficiencies. If the deficiency or significant deficiency is industry specific, also identify the industry.

review captain to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of pass.

l. In a report with a peer review rating of pass with deficiencies, fn 12 state:

i. That as a result ofbecause of the deficiencies previously described, the


103



review captain believes that at least one but not all of the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of pass with deficiencies.

m. In a report with a peer review rating of fail, state:

i. That as a result ofbecause of the deficiencies previously described, the review captain believes that all the engagements

104



submitted for review were not performed or reported on in conformity with applicable professional standards in all material respects.

ii. That the firm has received a peer review rating of fail.

n. In a report with a peer review rating of pass with deficiencies or fail:

i. Include descriptions of the deficiencies or significant deficiencies (each of these should be numbered) (see interpretations).

ii. IdentifyIf there are any repeat deficiencies or significant

105



deficiencies, state that the deficiency [or significant deficiency, as applicable] was noted in the firm’s previous peer review.2 that were also made in the report in the firm’s previous peer review. However, if the specific types of reporting, presentation, disclosure, or documentation deficiencies or significant deficiencies are not substantially the same on the current review as on the prior review, the deficiencies or significant deficiencies would not be considered

2 If there are repeat deficiencies or significant deficiencies that have occurred on two or more prior reviews the reviewer should state in the current report that, “this deficiency [or significant deficiency, as applicable] was noted on previous reviews.”

106



a repeat (see interpretations).

iii. Identify the level of service for any deficiencies or significant deficiencies. If the deficiency or significant deficiency is industry specific, also identify the industry.

Firm Responses in an Engagement Review and Related Review Captain Considerations

.123 The firm should discuss matters, findings, deficiencies, and significant deficiencies with the review captain. If the firm disagrees with one or more of the findings, deficiencies, or significant deficiencies, the firm should contact the administering entity for assistance and follow the guidance in paragraph .116 to resolve the disagreement.

Place in firm requirements section.

.124 The firm should respond to all matters communicated on an MFC form, findings communicated on an FFC form, and deficiencies or significant deficiencies communicated in the peer review report. The firm’s response to deficiencies or

Place in firm requirements section.

107



significant deficiencies should be communicated in a letter of response addressed to the administering entity’s peer review committee. The firm’s draft responses should be provided to the review captain as soon as practicable to allow the review captain sufficient time to assess the firm’s response prior to the exit conference.

.125 If the firm receives an FFC form or a report with a peer review rating of pass with deficiencies or fail, it is the firm’s responsibility to identify the appropriate remediation of findings, deficiencies, and significant deficiencies and to appropriately respond (see interpretations). The reviewed firm should address the firm’s actions taken or planned to remediate the findings, deficiencies or significant deficiencies, including timing of the remediation and additional procedures to ensure the finding, deficiency, or significant deficiency is not repeated in the future.

125 If the firm receives an FFC form or a report with a peer review rating of pass with deficiencies or fail, it is the firm’s responsibility to identify the appropriate remediation of findings, deficiencies, and significant deficiencies and to appropriately respond (see interpretations). The reviewed firm should address the firm’s actions taken or planned to remediate the findings, deficiencies or significant deficiencies, including timing of the remediation and additional procedures to ensure the finding, deficiency, or significant deficiency is not repeated in the future.

Moved last sentence to the following paragraph. First sentence should be in firm requirements.

.126 The review captain should review and evaluate the responses on the FFC forms and letter of response

220.19.126 The review captain should review and evaluate the responses

Highlighted item should be in firm section.

108



prior to the exit conference. The appropriateness of the firm’s response should be discussed during the exit conference. The firm’s letter of response should be finalized and dated as of the exit conference date and provided to the review captain. The review captain should include the firm’s letter of response with his or her report and working papers submitted to the administering entity (see interpretations).

on the FFC forms and letter of response prior to the exit conference. The review captain should consider the following:

a. the firm’s response should include;

i.the firm’s actions taken or planned to remediate the findings, deficiencies or significant deficiencies,

ii.including timing of the remediation, and

iii.additional procedures to ensure the finding, deficiency, or significant deficiency is not repeated in the future

b. the action should be feasible, genuine, and comprehensive

c. If the firm has taken action, the review team should review documentation of the actions taken and consider whether the action is appropriate.

The appropriateness of the firm’s response should be discussed

1st sentence of last paragraph moved to exit conference paragraph Last sentence removed b/c covered in the submission of workpapers paragraph.

109



during the exit conference. The firm’s letter of response should be finalized and dated as of the exit conference date and provided to the review captain. The review captain should include the firm’s letter of response with his or her report and working papers submitted to the administering entity (see interpretations).

.127 Illustrations of letters of responses by a reviewed firm to reports with a peer review rating of pass with deficiencies and fail are included in appendixes O, “Illustration of a Response by a Reviewed Firm to a Report With a Peer Review Rating of Pass With Deficiencies in an Engagement Review,” and Q, “Illustration of a Response by a Reviewed Firm to a Report With a Peer Review Rating of Fail in an Engagement Review.”

Place in application guidance for firms.

Appendix A

Summary of the Nature, Objectives, Scope, Limitations of, and Procedures Performed in System and Engagement Reviews and Quality Control Materials Reviews (as Referred to in a Peer Review Report)

Is Appendix A necessary?

110



.207 (Effective for Peer Reviews Commencing on or After January 1, 2009)

1. Firms (and individuals) enrolled in the AICPA Peer Review Program are required to have a peer review, once every three years, of their accounting and auditing practice. An accounting and auditing practice for the purposes of these standards is defined as all engagements performed under Statements on Auditing Standards (SASs); Statements on Standards for Accounting and Review Services (SSARSs); Statements on Standards for Attestation Engagements (SSAEs); Government Auditing Standards (the Yellow Book) issued by the U.S. Government Accountability Office; and engagements performed under Public Company Accounting Oversight Board (PCAOB) standards. Engagements covered in the scope of the program are those included in the firm’s accounting and auditing practice that are not subject to PCAOB permanent inspection. A firm is not required to enroll in the AICPA Peer Review Program if its only level of service is performing preparation engagements under SSARSs, however, if it elects to enroll due to licensing or other requirements, it is required to have a peer review under these Standards. The peer review is conducted by an independent evaluator, known as a peer reviewer. The AICPA oversees the program, and the review is

111



administered by an entity approved by the AICPA to perform that role.

2. The peer review helps to monitor a CPA firm’s accounting and auditing practice (practice monitoring). The goal of the practice monitoring, and the program itself, is to promote and enhance quality in the accounting and auditing services provided by the CPA firms subject to these standards. This goal serves the public interest and enhances the significance of AICPA membership and accounting and audit quality.

3. There are two types of peer reviews: System Reviews and Engagement Reviews. System Reviews focus on a firm’s system of quality control and Engagement Reviews focus on work performed on particular selected engagements. Quality Control Materials (QCM) Reviews focus on the system of quality control of a provider of QCM to CPA firms. A further description of System, Engagement, and QCM Reviews, as well as a summary of the nature, objectives, scope, limitations of, and procedures performed on them, is provided in the following sections.

System Reviews

4. A System Review is a type of peer review that is a study and appraisal by an independent evaluator(s), known as a peer reviewer, of a CPA firm’s system of quality control to perform

112



accounting and auditing work. The system represents the policies and procedures that the CPA firm has designed, and is expected to follow, when performing its work. The peer reviewer’s objective is to determine whether the system is designed to ensure conformity with professional standards and whether the firm is complying with its system appropriately.

5. Professional standards are literature, issued by various organizations, that contain the framework and rules that a CPA firm is expected to comply with when designing its system and when performing its work. Professional standards for design of a system of quality control include but are not limited to the Statements on Quality Control Standards (SQCSs) issued by the AICPA that pertain to leadership responsibilities for quality within the firm (the “tone at the top”); relevant ethical requirements (such as independence, integrity and objectivity); acceptance and continuance of client relationships and specific engagements; human resources; engagement performance; and monitoring.

6. To plan a System Review, a peer reviewer obtains an understanding of (1) the firm’s accounting and auditing practice, such as the industries of its clients, and (2) the design of the firm’s system, including its policies and procedures and how the firm checks itself that it is complying with them. The reviewer assesses the risk levels

113



implicit within different aspects of the firm’s practice and its system. The reviewer obtains this understanding through inquiry of firm personnel and review of documentation on the system, such as firm manuals.

7. Based on the types of engagements firms perform, they may also have their practices reviewed or inspected on a periodic basis by regulatory or governmental entities, including but not limited to the Department of Health and Human Service, the Department of Labor, and the PCAOB. The team captain obtains an understanding of those reviews or inspections, and he or she considers their impact on the nature and extent of the peer review procedures performed.

8. Based on the peer reviewer’s planning procedures, the reviewer looks at a sample of the CPA firm’s work, individually called engagements. The reviewer selects engagements for the period covered by the review from a cross section of the firm’s practice with emphasis on higher risk engagements. The engagements selected must include those performed under Government Auditing Standards, audits of employee benefit plans, audits of depository institutions (with assets of $500 million or greater), audits of broker-dealers, and examinations of service organizations (SOC 1® and SOC 2® engagements) when applicable (these are known as must select engagements). The scope of a peer review only covers accounting and auditing

114



engagements performed under SASs, SSARSs, SSAEs, Government Auditing Standards, and PCAOB standards and does not include the firm’s engagements subject to PCAOB permanent inspection, nor does it include tax or consulting services. The reviewer will also look at administrative elements of the firm’s practice to test the elements listed previously from the SQCSs.

9. The reviewer examines engagement working paper files and reports, interviews selected firm personnel, reviews representations from the firm, and examines selected administrative and personnel files. The objectives of obtaining an understanding of the system and then testing the system forms the basis for the reviewer’s conclusions in the peer review report.

10. When a CPA firm receives a report from the peer reviewer with a peer review rating of pass, the report means that the system is appropriately designed and being complied with by the CPA firm in all material respects. If a CPA firm receives a report with a peer review rating of pass with deficiencies, this means the system is designed and being complied with appropriately by the CPA firm in all material respects, except in certain situations that are explained in detail in the peer review report. When a firm receives a report with a peer review rating of fail, the peer reviewer has determined that the firm’s system is not suitably designed or being

115



complied with, and the reasons why are explained in detail in the report.

11. If a deficiency or significant deficiency included in the peer review report is associated with an engagement that was not performed and reported on in conformity with applicable professional standards in all material respects (“nonconforming”) in a must select industry or practice area or is industry specific, the report will identify the industry or practice area. However, because the purpose of a System Review is to report on the firm’s system of quality control, the peer review report might not describe every engagement that was deemed nonconforming.

12. The firm is responsible for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, when appropriate, and for remediating weaknesses in its system of quality control, if any. The firm’s response is evaluated to determine if it is appropriate, whether lack of response is indicative of other weaknesses in the firm’s system of quality control, or whether monitoring procedures are necessary to verify if the deficiencies and nonconforming engagements were remediated.

13. There are inherent limitations in the effectiveness of any system and, therefore, noncompliance with the system may occur and not

116



be detected. A peer review is based on selective tests. It is directed at assessing whether the design of and compliance with the firm’s system provides the firm with reasonable, not absolute, assurance of conforming to applicable professional standards. Consequently, it would not necessarily detect all weaknesses in the system or all instances of noncompliance with it. It does not provide assurance with respect to any individual engagement conducted by the firm or that none of the financial statements audited by the firm should be restated. Projection of any evaluation of a system to future periods is subject to the risk that the system may become inadequate because of changes in conditions or because the degree of compliance with the policies or procedures may deteriorate.

Engagement Reviews

14. An Engagement Review is a type of peer review that is a study and appraisal by an independent evaluator(s), known as a peer reviewer, of a sample of a CPA firm’s actual accounting work, including accounting reports issued and documentation prepared by the CPA firm, as well as other procedures that the firm performed.

15. By definition, CPA firms undergoing Engagement Reviews do not perform audits or other similar engagements but do perform other accounting work including reviews and compilations, which are a lower level of service than

117



audits. The peer reviewer’s objective is to evaluate whether the CPA firm’s reports are issued and procedures performed appropriately in accordance with applicable professional standards. Therefore, the objective of an Engagement Review is different from the objectives of a System Review, which is more system oriented and involves determining whether the system is designed in conformity with applicable professional standards and whether the firm is complying with its system appropriately.

16. Professional standards represent literature, issued by various organizations, that contain the framework and rules that a CPA firm is expected to follow when performing accounting work.

17. The reviewer looks at a sample of the CPA firm’s work, individually called engagements. The scope of an Engagement Review only covers accounting engagements; it does not include tax or consulting services. An Engagement Review consists of reading the financial statements or information submitted by the reviewed firm and the accountant’s report thereon, together with certain background information and representations from the firm and, except for certain compilation engagements, the documentation required by applicable professional standards.

18. When the CPA firm receives a report with a peer review rating of pass, the peer reviewer has concluded that nothing came to his or her attention

118



that the CPA firm’s work was not performed and reported on in conformity with applicable professional standards in all material respects. A report with a peer review rating of pass with deficiencies is issued when the reviewer concludes that nothing came to his or her attention that the work was not performed and reported on in conformity with applicable professional standards in all material respects, except in certain situations that are explained in detail in the report. A report with a peer review rating of fail is issued when the reviewer concludes that as a result of the situations described in the report, the work was not performed or reported on in conformity with applicable professional standards in all material respects.

19. If a deficiency or significant deficiency is industry specific, the report will identify the industry.

20. The firm is responsible for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, when appropriate, and for remediating weaknesses in its system of quality control, if any.

21. An Engagement Review does not provide the reviewer with a basis for expressing any assurance as to the firm’s system of quality control for its

119



accounting practice, and no opinion or any form of assurance is expressed on that system.

Quality Control Materials Reviews

22. An organization (hereinafter referred to as provider) may sell or otherwise distribute quality control materials (QCM or materials) that it has developed to CPA firms (hereinafter referred to as user firms). QCM may be all or part of a user firm’s documentation of its system of quality control, and it may include manuals, guides, programs, checklists, practice aids (forms and questionnaires) and similar materials intended for use in conjunction with a user firm’s accounting and auditing practice. User firms rely on QCM to assist them in performing and reporting in conformity with the professional standards covered by the materials (as described in the preceding paragraphs).

23. A QCM review is a study and appraisal by an independent evaluator (known as a QCM reviewer) of a provider’s materials, as well as the provider’s system of quality control to develop and maintain the materials (hereinafter referred to as provider’s system). The QCM reviewer’s objective is to determine whether the provider’s system is designed and complied with and whether the materials produced by the provider are appropriate so that user firms can rely on the materials. The scope of a QCM review only covers materials related to accounting and auditing engagements

120



under U.S. professional standards. The scope does not include SEC or PCAOB guidance, nor does it cover materials for tax or consulting services.

24. To plan a QCM review, a QCM reviewer obtains an understanding of (1) the provider’s QCM, including the industries and professional standards that they cover, and (2) the design of the provider’s system, including the provider’s policies and procedures and how it ensures that they are being complied with. The QCM reviewer assesses the risk levels implicit within different aspects of the provider’s system and materials. The QCM reviewer obtains this understanding through inquiry of provider personnel, review of documentation on the provider’s system, and review of the materials.

25. Based on the planning procedures, the QCM reviewer looks at the provider’s QCM, including the instructions, guidance, and methodology therein. The scope of a QCM review encompasses those materials which the provider elects to include in the QCM review report; QCM designed to aid user firms with tax or other non-attest services are outside of the scope of this type of review. The QCM reviewer will also look at the provider’s system and will test elements including, but not limited to, requirements regarding the qualifications of authors and developers, procedures for ensuring that the QCM are current, procedures for reviewing the technical accuracy of the materials, and procedures for soliciting feedback from users. The

121



extent of a provider’s policies and procedures and the manner in which they are implemented will depend upon a variety of factors, such as the size and organizational structure of the provider and the nature of the materials provided to users. Variance in individual performance and professional interpretation affects the degree of compliance with prescribed quality control policies and procedures. Therefore, adherence to all policies and procedures in every case may not be possible. The objectives of obtaining an understanding of the provider’s system and the materials forms the basis for the QCM reviewer’s conclusions in the QCM review report.

26. When a provider receives a QCM review report from an approved QCM reviewer with a review rating of pass, this means the provider’s system is designed and being complied with and the materials produced by the provider are appropriate so that user firms can rely on the QCM to assist them in performing and reporting in conformity with the professional standards covered by the materials. If a provider receives a QCM review report with a review rating of pass with deficiencies, this means the provider’s system is designed and being complied with and the materials produced by the provider are appropriate so that user firms can rely on the QCM to assist them in performing and reporting in conformity with the professional standards covered by the materials, except in certain situations that are explained in detail in the review report. When a provider receives a report with a

122



review rating of fail, the QCM reviewer has determined that the provider’s system is not suitably designed or being complied and the materials produced by the provider are not appropriate, and the reasons why are explained in detail in the report.

27. The provider is responsible for evaluating actions to promptly remediate materials not deemed as reliable aids, when appropriate, and for remediating weaknesses in its system of quality control, if any. The provider’s response is evaluated to determine if it is appropriate and whether lack of response is indicative of other weaknesses in the provider’s system of quality control.

28. There are inherent limitations in the effectiveness of any system and, therefore, noncompliance with the system may occur and not be detected. A QCM review is based on the review of the provider’s system and its materials. It is directed at assessing whether the provider’s system is designed and complied with and whether the QCM produced by the provider are appropriate so that user firms have reasonable, not absolute, assurance that they can rely on the materials to assist them in performing and reporting in conformity with the professional standards covered by the materials. Consequently, a QCM review would not necessarily detect all weaknesses in the provider’s system, all instances of noncompliance with it, or all aspects of the materials that should not be relied upon. Projection of any evaluation of a system or the materials to future

123



periods is subject to the risk that the system or materials may become inadequate because of changes in conditions or because the degree of compliance with the policies or procedures may deteriorate.

124

Exhibit B

PRP SECTION 2000

MAPPING DOCUMENT


PRP Section 2000 PRP-C Explanation

3-3

Question—When performing the peer review of an enrolled individual in the program, what type of peer review would be required, what peer review materials would be used, and what changes would be necessary to the peer review report?

Interpretation—As with any peer review, the types of engagements performed dictate the type of peer review required. Because the enrolled individual could only be performing compilation services, this would only require an Engagement Review, although the individual could undergo a System Review. The current peer review materials can still be used as long as the peer reviewer indicates that the peer review was that of an enrolled individual and not of a firm or organization. Similarly, the report and, if applicable, the letter of response, as well as other peer review documents and correspondences, should be tailored so that it is very clear that only the individual is being peer reviewed and not the firm or organization.

Is this application guidance?

125



Concluding on the Review of an Engagement

66-1

Question—Paragraphs .66–.67 and .109 of the standards requires the review team to conclude on the review of an engagement by determining whether the engagement was performed or reported on in conformity with applicable professional standards in all material respects. How should this conclusion be made?

Interpretation—The review team should use practice aids that document, for each engagement reviewed, whether anything came to the review team’s attention that caused it to believe the following, as applicable:

a. The financial statements were not in conformity with GAAP in all material respects or, if applicable, with a special purpose framework fn 5 and the auditor or accountant’s report was not appropriately modified.

66-1

Question—Paragraphs .66–.67 and .109 of the standards requires the review team to conclude on the review of an engagement by determining whether the engagement was performed or reported on in conformity with applicable professional standards in all material respects. How should this conclusion be made?

Interpretation—

220.11 For each engagement reviewed, Tthe review team should use practice aidspeer review checklists and questionnaires that document the following, for each engagement reviewed, whether anything came to the review team’s attention that caused it to believe the following, as applicable:


126



b. The firm did not perform or report on the engagement in all material respects in accordance with generally accepted auditing standards and other applicable standards; for example, Government Auditing Standards.

c. The firm did not perform or report on the engagement in all material respects in accordance with SSARS.

d. The firm did not perform or report on the engagement in all material respects in accordance with SSAEs or any other applicable standards not encompassed in the preceding.

In Engagement Reviews, these results should be considered by the review captain in determining the type of report to issue.

a. The financial statements were not in conformity with GAAP in all material respects or, if applicable, with a special purpose framework fn 5 and the auditor or accountant’s report was not appropriately modified.

b. The firm did not perform or report on the engagement in all material respects in accordance with generally accepted auditing standards and other applicable standards; for example, Government Auditing Standards.

c. The firm did not perform or report on the engagement in all material respects in accordance with SSARS or SSAEs.

d. The firm did not perform or report on the engagement in all material respects in accordance with SSAEs or any other applicable standards not encompassed in the preceding.


127



220.25 To determine the type of report to issue, In Engagement Reviews,the review captain should use the these results should be considered by the review captain in determining the type of report to issueof the evaluation of engagements reviewed.

67-1

Question—Paragraphs .67 and .109 of the standards notes that the team captain or review captain should promptly inform the firm when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its responsibilities under professional standards to take appropriate actions. How is this communication made?

• Interpretation—If the reviewer concludes that an engagement is not performed or reported on in conformity with applicable professional standards in all material respects, the team captain or review captain should promptly inform an appropriate member of the reviewed firm on an MFC form. The team captain or review captain should remind the reviewed firm of its responsibilities under professional standards

67-1

Question—Paragraphs .67 and .109 of the standards notes that the team captain or review captain should promptly inform the firm when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its responsibilities under professional standards to take appropriate actions. How is this communication made?

Interpretation—

If the reviewer concludes that an engagement is not performed or reported on in conformity with applicable professional standards in all material respects, the team captain or review captain should promptly inform an appropriate member

Included the MFC requirement in 220.17 The references to standards in not necessary. The remainder of the bullets belong in firm guidance.

128



to take appropriate actions as addressed in the following professional standards, as applicable:AU-C section 560, Subsequent Events and Subsequently Discovered Facts (AICPA, Professional Standards)

• SSARS No. 19, Framework for Performing and Reporting on Compilation and Review Engagements (AICPA, Professional Standards, AR sec. 60, 80, and 90), or SSARS No. 21, Statements on Standards for Accounting and Review Services: Clarification and Recodification (AICPA, Professional Standards, AR-C sec. 60, 70, 80, and 90) as applicable

• AU-C section 585, Consideration of Omitted Procedures After the Report Release Date (AICPA, Professional Standards)

• The “Breach of Independence” interpretation (AICPA, Professional Standards, ET sec. 1.298.010)

• The reviewed firm should investigate the issue questioned by the review team and determine what timely action, if any, should be taken, including actions planned or taken to prevent unwarranted continued reliance on its previously issued reports. The reviewed

of the reviewed firm on an MFC form. The team captain or review captain should remind the reviewed firm of its responsibilities under professional standards to take appropriate actions as addressed in the following professional standards, as applicable:AU-C section 560, Subsequent Events and Subsequently Discovered Facts (AICPA, Professional Standards)

SSARS No. 19, Framework for Performing and Reporting on Compilation and Review Engagements (AICPA, Professional Standards, AR sec. 60, 80, and 90), or SSARS No. 21, Statements on Standards for Accounting and Review Services: Clarification and Recodification (AICPA, Professional Standards, AR-C sec. 60, 70, 80, and 90) as applicable

AU-C section 585, Consideration of Omitted Procedures After the Report Release Date (AICPA, Professional Standards)

The “Breach of Independence” interpretation (AICPA, Professional Standards, ET sec. 1.298.010)

129



firm should then advise the team captain or review captain of the results of its investigation, including parties consulted, and document the actions planned or taken or its reasons for concluding that no action is required as follows:In the firm’s response to the MFC form

• In the firm’s response to the FFC form, if applicable

• In the firm’s letter of response to deficiencies and significant deficiencies identified in the report, if applicable

The firm is also expected to make a representation in its representation letter to the team or review captain confirming it will remediate nonconforming engagements as stated by the firm on its MFC forms, FFC forms, or letter of response, as applicable.

• The reviewed firm should investigate the issue questioned by the review team and determine what timely action, if any, should be taken, including actions planned or taken to prevent unwarranted continued reliance on its previously issued reports. The reviewed firm should then advise the team captain or review captain of the results of its investigation, including parties consulted, and document the actions planned or taken or its reasons for concluding that no action is required as follows:In the firm’s response to the MFC form

• In the firm’s response to the FFC form, if applicable

• In the firm’s letter of response to deficiencies and significant deficiencies identified in the report, if applicable

The firm is also expected to make a representation in its representation letter to the team or review captain confirming

130



it will remediate nonconforming engagements as stated by the firm on its MFC forms, FFC forms, or letter of response, as applicable.

67-2

Question—Paragraphs .67 and .109 of the standards note that the team captain or review captain should promptly inform the firm when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its responsibilities under professional standards to take appropriate actions. What other responsibilities do the team and review captain have when nonconforming engagements are identified?

Interpretation—Reviewers or administering entities should not instruct firms to perform omitted procedures, reissue accounting or auditing reports, or have previously issued financial statements revised and reissued because those are decisions for the firm and its client to make. However, the administering entity can require the firms to make and document appropriate considerations regarding such engagements as a condition of acceptance of the peer review. The firm’s response may affect other monitoring actions the administering entity’s

67-2

Question—Paragraphs .67 and .109 of the standards note that the team captain or review captain should promptly inform the firm when an engagement is not performed or reported on in conformity with applicable professional standards in all material respects and remind the firm of its responsibilities under professional standards to take appropriate actions. What other responsibilities do the team and review captain have when nonconforming engagements are identified?

Interpretation—Reviewers or administering entities should not instruct firms to perform omitted procedures, reissue accounting or auditing reports, or have previously issued financial statements revised and reissued because

First sentence moved to 220.A7 (par. 99-1)

131



peer review committee may impose, including actions to verify that the firm adheres to the intentions indicated in its response.

If the firm has taken action, ordinarily the review team should review documentation of such actions (for example, omitted procedures performed, reissued report and financial statements, or notification to users to discontinue use of previously issued reports) and consider whether the action is appropriate. If the firm has not taken action, the review team should consider whether the planned actions are appropriate (genuine, comprehensive, and feasible).

On a System Review, the team captain should consider expanding scope to determine the pervasiveness of the nonconforming engagements. The extent of the nonconforming engagements is considered when determining the systemic cause and whether the matter should be elevated to a finding, deficiency, or significant deficiency.

Refer to paragraphs .68 and .84 of the standards for additional guidance on assessing when to expand scope and when matters may be isolated. Refer to Interpretation 100-1 for additional guidance for the evaluation of a firm’s response.

those are decisions for the firm and its client to make. However,

220.A9 tThe administering entity’s peer review committee (committee) maycan require the firms to make and document appropriate considerations regarding suchnonconforming engagements as a condition of acceptance of the peer review. The firm’s response may affect other monitoring actions the administering entity’s peer review committee may impose, including actions to verify that the firm adheres to the intentions indicated in its response.

220.19 c. If the firm has taken action, ordinarily the review team should review documentation of suchthe actions taken and consider whether the action is appropriate. .

220.A10 (for eExamples of firm actions taken in response to nonconforming engagements may include, but not be limited to;,

a. omitted procedures performed,

b. reissued report and financial statements, or

132



a.c. notification to users to discontinue use of previously issued reports) and consider whether the action is appropriate. If the firm has not taken action, the review team should consider whether the planned actions are appropriate (genuine, comprehensive, and feasible).

On a System Review, the team captain should consider expanding scope to determine the pervasiveness of the nonconforming engagements. The extent of the nonconforming engagements is considered when determining the systemic cause and whether the matter should be elevated to a finding, deficiency, or significant deficiency.

Refer to paragraphs .68 and .84 of the standards for additional guidance on assessing when to expand scope and when matters may be isolated. Refer to Interpretation 100-1 for additional guidance for the evaluation of a firm’s response.

133




91-1

Question—Paragraphs .91–.92 and .115 of the standards instruct peer reviewers on communicating con-clusions at the closing meeting and exit conference. What other guidelines should be followed?

Interpretation—The peer reviewer should consider the need to have the team member(s) participate or be available for consultation (in person or via teleconference) during the closing meeting or exit conference, especially when, in unusual circumstances, the team or review captain does not have the experience to review the industry of an engagement that was reviewed by the team member.

· Furthermore, for System Reviews, the closing meeting and exit conference are not the appropri-ate place or time to surprise the firm with the intention of issuing a pass with deficiency or fail re-port or to discuss any unresolved accounting and auditing issues. It is expected that the team captain will have an open means of communication with various levels of personnel leading up to the closing meeting, having at a minimum and as applicable,promptly informed them when an engagement is not performed or

220.A13 Team members may participate in or be available for the closing meeting and exit conference. This may be useful when the review captain does not have the experience to review the industry of an engagement that was reviewed by the team member.

For engagement reviews, left as a general application guidance b/c there typically aren’t team members

134



reported on in conformity with applicable professional stand-ards;

· discussed MFC and FFC forms including the systemic causes and related remedial actions of the firm for any matters, findings, deficiencies, and significant deficiencies in advance; and

· followed up on open questions and issues.

The closing meeting should ordinarily occur at least 30 days prior to the firm’s due date to allow suffi-cient time for the firm to determine appropriate remediation with respect to findings, deficiencies, and significant deficiencies, if applicable. The exit conference should be used as a time to communicate the final results of the peer review and should only be conducted after the peer reviewer has assessed the appropriateness of the firm’s responses on the MFC forms, FFC forms, and letter of response, if applica-ble.

135



91-2

Question—Paragraphs .91 and .115 of the standards states the reviewer should discuss matters, findings, deficiencies and significant deficiencies with the firm at the closing meeting. Does the reviewer need to document these items on MFC Forms, FFC Forms, and in the report, respectively, prior to the closing meeting or can that be performed subsequent to the closing meeting?

Interpretation—Prior to and during the closing meeting, the reviewer should provide the firm with the details supporting why a matter, finding, deficiency or significant deficiency have been identified. However, the documentation of these items on MFC forms, FFC forms, and in the report may occur after the closing meeting. The reviewer should ensure that the forms and deficiency descriptions are provided to the firm with sufficient time for the firm to document its response and for the reviewer to assess that response prior to the exit conference.

This interpretation contradicts the requirement to notify the firm of non-conforming engagements on MFC forms. Consider if this should remain? Or is application guidance?

Notification and Submission of Peer Review Documentation to the Administering Enti-ties by the Team Captain or Review Captain

Notification and Submission of Peer Review Documentation to the Administering

Is notification necessary?

136



Enti-ties by the Team Captain or Review Captain

94-1

Question—Paragraphs .94, .120, and .190 of the standards instruct a reviewer to see the interpretations for guidance on notification requirements and submission of peer review documentation to the administering entity. What materials should be submitted by the team captain or review captain, and when should they be submitted by?

Interpretation—The team captain or review captain should notify the administering entity that the review has been performed. Within 30 days of the exit conference date or by the firm’s peer review due date, whichever date is earlier, the team captain should submit the following documentation to the administering entity.

For System and Engagement Reviews:

• Report and letter of response, if applicable

• Summary Review Memorandum, or Review Captain Summary, as applicable

94-1

Question—Paragraphs .94, .120, and .190 of the standards instruct a reviewer to see the interpretations for guidance on notification requirements and submission of peer review documentation to the administering entity. What materials should be submitted by the team captain or review captain, and when should they be submitted by?

Interpretation—The team captain or review captain should notify the administering entity that the review has been performed.

220.29 Within 30 days of the exit conference date or by the firm’s peer review due date, whichever date is earlier, the teamreview captain should submit or complete electronically, as applicable, the following documentsation to the administering entity. (Ref. par. .A20)

Consider if this should be reworded due to PRIMA.

137



• Engagement Summary Form (For Engagement Reviews)

• FFC forms, as applicable

• MFC forms, submitted electronically or hard copy, as applicable

• DMFC form, submitted electronically or hard copy, as applicable

• Firm’s representation letter

• Section 22100—Part A, Supplemental Checklist for Review of Single Audit Act/A-133 Engagements, or Section 22100—Part A—UG, Supplemental Checklist for Review of Single Audit Engagements (Uniform Guidance), and engagement profile(s) for single audit engagements reviewed (if applicable) (for System Reviews)

• Appendix A “Explanation of No Answers” for the PRPM Section 4500 or 4600 “Guidelines for Review of Quality Control Policies and Procedures” and 4550 or 4650 “Guidelines for Testing Compliance with Quality Control Policies and Procedures”

For all reviews administered by the National PRC, as applicable:

For System and Engagement Reviews:

• Report and letter of response, if applicable

• Summary Review Memorandum, or Review Captain Summary, as applicable

• Engagement Review Summary Form (For Engagement Reviews)

• FFCs forms, as applicable

• MFCs forms, submitted electronically or hard copy, as applicable

• DMFCs form, submitted electronically or hard copy, as applicable

• Firm’s representation letter

220.30 Electronic completion is required for some documentation

• , Supplemental Checklist for Review of Single Audit Act/A-133 Engagements, or , Supplemental Checklist for Review of Single Audit Engagements (Uniform

138



• All of the documents required to be submitted for System Reviews and Engagement Reviews

• Engagement questionnaires or checklists

• Quality control documents and related practice aids

• Staff and focus group interview forms

• Planning documents

• Any other relevant documents

Note that all peer review working papers are subject to oversight procedures and may be requested at a later date.

Peer review working papers may be submitted to the administering entity electronically.

Guidance), and engagement profile(s) for single audit engagements reviewed (if applicable) (for System Reviews)

• Appendix A “Explanation of No Answers” for the PRPM Section 4500 or 4600 “Guidelines for Review of Quality Control Policies and Procedures” and 4550 or 4650 “Guidelines for Testing Compliance with Quality Control Policies and Procedures”

• For all reviews administered by the National PRC, as applicable:

• All of the documents required to be submitted for System Reviews and Engagement Reviews

• Engagement questionnaires or checklists

• Quality control documents and related practice aids

• Staff and focus group interview forms

• Planning documents

• Any other relevant documents

139



220.A20 Note that aAll peer review working papers are subject to oversight procedures and may be requested at a later date.

Peer review working papers may be submitted to the administering entity electronically.

Reporting on System and Engagement Reviews When a Report With a Peer Review Rating of Pass With Deficiency or Fail Is Issued

96n-1

Question—Paragraphs .96(n) and .122(n) of the standards instruct a team captain in a System Review (or review captain on an Engagement Review) to identify, for any deficiencies or significant deficiencies included in the report with a peer review rating of pass with deficiencies or fail, any that were also made in the report issued on the firm’s previous peer review. What further guidance is available in regards to this requirement?

Interpretation—On System Reviews, a repeat is a deficiency or significant deficiency noted during the current review that was caused by the same system of quality control weakness noted in the prior

On Engagement Reviews, aA repeat is one in which the identified engagement deficiency or significant deficiency is substantially the same (that is, the same kind or very similar) as noted in the prior review’s report as it relates to reporting, presentation, disclosure or documentation.

220.A19 AnFor example of a repeat deficiency or significant deficiency may be, if a reviewer notes an engagement that had a disclosure or a financial statement presentation deficiency in a prior review’s report or prior year FFC, the disclosure or financial statement presentation deficiency noted in the current review would

Did not include the first section for system reviews. Include repeat finding and repeat deficiency in definitions (highlighted) Changed the report requirements to include the verbiage in this interpretation. Added the plural reference in a footnote.

140



review’s report. The review team should read the prior report and letter of response and evaluate whether corrective actions discussed have been implemented to determine whether the systemic cause is the same. The deficiency or significant deficiency should note that “This deficiency [or significant deficiency, as applicable] was noted in the firm’s previous peer review.”

If the corrective actions have been implemented and the same deficiency or significant deficiency is occurring, the review team, in collaboration with the firm, should determine the weakness in the firm’s system of quality control that is causing the deficiency or significant deficiency to occur. In this case, if the prior corrective actions appear to be effective, the deficiency or significant deficiency may be caused by some other weakness in the firm’s system of quality control. If the systemic cause of the deficiency or significant deficiency is different from that reported in the prior review, it would not be a repeat.

The preceding also applies when the deficiency or significant deficiency noted during the current review was caused by the same system of quality control weakness noted on a FFC form in the prior review. The team captain should consider if the firm’s planned actions to remediate the prior review findings were implemented, including implementation plans or those discussed in the firm’s response on the FFC form. If the prior

need to be substantially the same disclosure or financial statement presentation deficiency to qualify as a repeat.

The preceding also applies when the deficiency or significant deficiency noted during the current review was substantially the same as was noted on a FFC form in the prior review. Under these circumstances, it would still be appropriate to use the same wording as previously described: “This deficiency [or significant deficiency, as applicable] was noted in the firm’s previous peer review.”

For System Reviews and Engagement Reviews in which

there are repeat deficiencies or significant deficiencies that have occurred on two or more prior reviews the reviewer should state in the current report that, “this deficiency [or significant deficiency, as applicable] was noted on previous reviews.”

320.AX A firm that repeatedly receives peer reviews with consistent deficiencies or significant deficiencies that are not corrected may be deemed as a firm refusing to cooperate. For such firms

320.AX is application for firms and should be placed in section 320

141



remedial actions appear to be effective, the current deficiency may be caused by some other weakness in or compliance with the firm’s system of quality control. If the systemic cause of the deficiency is different from that noted in the prior review, it would not be a repeat. If the systemic cause is determined to be the same, under these circumstances, it would still be appropriate to use the same wording as previously described “This deficiency [or significant deficiency, as applicable] was noted in the firm’s previous peer review.” If the systemic cause is the same, the review team should also consider whether there are deficiencies in other elements of quality control.

See section 3100, Supplemental Guidance, for an example of identifying repeat findings, deficiencies and significant deficiencies in a System Review.

On Engagement Reviews, a repeat is one in which the identified engagement deficiency or significant deficiency is substantially the same (that is, the same kind or very similar) as noted in the prior review’s report as it relates to reporting, presentation, disclosure or documentation. For example, if a reviewer notes an engagement that had a disclosure or a financial statement presentation deficiency in a prior review’s report, the disclosure or financial statement presentation deficiency noted in the current review would need to be substantially the

that fail to cooperate, the AICPA Peer Review Board may decide, pursuant to fair procedures that it has established, to appoint a hearing panel to consider whether the firm’s enrollment in the AICPA peer review program should be terminated or some other action taken. Therefore, it is critical that peer reviewers appropriately identify the systemic causes of deficiencies and significant deficiencies on System Reviews and that reporting on System and Engagement Reviews is appropriate

142



same disclosure or financial statement presentation deficiency to qualify as a repeat.

The preceding also applies when the deficiency or significant deficiency noted during the current review was substantially the same as was noted on a FFC form in the prior review. Under these circumstances, it would still be appropriate to use the same wording as previously described: “This deficiency [or significant deficiency, as applicable] was noted in the firm’s previous peer review.”

For System Reviews and Engagement Reviews in which there are repeat deficiencies or significant deficiencies that have occurred on two or more prior reviews the reviewer should state in the current report that, “this deficiency [or significant deficiency, as applicable] was noted on previous reviews.”

A firm that repeatedly receives peer reviews with consistent deficiencies or significant deficiencies that are not corrected may be deemed as a firm refusing to cooperate. For such firms that fail to cooperate, the AICPA Peer Review Board may decide, pursuant to fair procedures that it has established, to appoint a hearing panel to consider whether the firm’s enrollment in the AICPA peer review program should be terminated or some other action taken. Therefore, it is critical that peer reviewers appropriately identify the systemic causes of deficiencies and significant deficiencies on

143



System Reviews and that reporting on System and Engagement Reviews is appropriate.

96p-1

Question—Paragraphs .96(p) and .122(n) of the standards instruct the peer reviewer to include, for reports with a peer review rating of pass with deficiency(ies) or fail, descriptions of the deficiencies or significant deficiencies. What is the treatment of FFCs, if any, when these reports are issued, and how are deficiencies treated for reports with a peer review rating of fail?

Interpretation—Any findings that are only raised to the level of a FFC remain in a FFC and are not included in a report with a peer review rating of pass with deficiency or fail.

A significant deficiency in a System Review is one or more deficiencies that the peer reviewer has concluded results from a condition in the reviewed firm’s system of quality control or compliance with it such that the reviewed firm’s system of quality control taken as a whole does not provide the reviewed firm with reasonable assurance of performing or reporting in conformity with applicable professional standards in all material respects. Such deficiencies are communicated in a

Recommend Removal Is this necessary

144



report with a peer rating of fail. Therefore, this is a systemic approach to determining whether the deficiencies identified meet this significant deficiency threshold. If they do, then a report with a peer review rating of fail is issued and all of the deficiencies are considered significant deficiencies and are identified as such. Such a report would not have a section with “Significant Deficiencies Identified in the Firm’s System of Quality Control” and another section for “Deficiencies Identified in the Firm’s System of Quality Control,” because they would all be categorized as significant deficiencies.

A significant deficiency on an Engagement Review exists when the review captain concludes that deficiencies are evident on all of the engagements submitted for review. Such deficiencies are communicated in a report with a peer review rating of fail. Therefore, on an Engagement Review, all of the engagements reviewed are considered concerning whether deficiencies were noted when determining if the significant deficiency threshold is met. If they do, then a report with a peer review rating with fail is issued and all of the deficiencies are considered significant deficiencies and are identified as such. Such a report would not have a section with “Significant Deficiencies Identified on the Firm’s Conformity With Professional Standards on Engagements Reviewed” and another section for “Deficiencies Identified on the Firm’s Conformity With Professional Standards on Engagements

145



Reviewed, if applicable,” because they would all be categorized as significant deficiencies.

Firm Responses in a System or Engagement Review

97-1

Question—Paragraphs .97 and .123 of the standards discuss the team captain or review captain’s responsibility to review, evaluate, and comment on the reviewed firm’s letter of response prior to its submission to the administering entity. What should be considered during that review?

Interpretation—The purpose of the letter of response is for a firm to stipulate, in writing, the specific action(s) that will be taken to correct deficiencies noted by the reviewer and, on a System Review, to enhance the current system of quality control. The description of the action(s) the firm has taken or will take should ensure prevention of recurrence of the deficiency or significant deficiency discussed in the report. The action(s) should be feasible, genuine, and comprehensive. The letter of response should not be vague or repetitive of the deficiency or significant deficiency in the report, because then it is difficult to determine if the planned action will be appropriately implemented to

Recommend removal b/c covered in requirements

Consider some of these points in Section 320.

146



ensure prevention; or if the action is inappropriate for correcting the deficiency or significant deficiency. The letter of response should not be used as a place to indicate justification for the firm’s actions that related to the deficiency or significant deficiency.

Firm Responses and Related Team or Review Captain Considerations

99-1

Question—Paragraphs .99 and .125 state that it is the firm’s responsibility to identify the appropriate remediation of any findings, deficiencies and significant deficiencies and to appropriately respond. Should the team or review captain assist with this assessment?

Interpretation—Although it is ultimately the firm’s responsibility, the team or review captain and firm may collaborate to determine the response. In a System Review, the response will address the appropriate systemic cause and remedial actions. The team captain should provide information about risks in the firm’s system of quality control (as identified through the Guidelines for Review and

99-1

Question—Paragraphs .99 and .125 state that it is the firm’s responsibility to identify the appropriate remediation of any findings, deficiencies and significant deficiencies and to appropriately respond. Should the team or review captain assist with this assessment?

Interpretation—

220.A7 Although it is ultimately the firm’s responsibility, the team or review captain and firm may collaborate to determine the response. Reviewers or administering entities should not instruct firms to perform omitted procedures,

147



Testing of Quality Control Policies and Procedures in sections 4500 to 4650).

reissue accounting or auditing reports, or have previously issued financial statements revised and reissued because those are decisions for the firm and its client to make. In a System Review, the response will address the appropriate systemic cause and remedial actions. The team captain should provide information about risks in the firm’s system of quality control (as identified through the Guidelines for Review and Testing of Quality Control Policies and Procedures in sections 4500 to 4650).

100-1

Question—Paragraphs .100 and .127 of the standards discuss the team captain or review captain’s responsibility to review and evaluate the reviewed firm’s responses on the FFC form and in the letter of response prior to submission to the administering entity with the peer review working papers. What should be considered during that review?

Interpretation—The purpose of the firm’s response on the FFC form and in the letter of response is for a firm to stipulate, in writing, the specific action(s) that will be taken to correct findings and deficiencies noted by the reviewer and, on a System Review, to enhance the current system of quality

100-1

Question—Paragraphs .100 and .127 of the standards discuss the team captain or review captain’s responsibility to review and evaluate the reviewed firm’s responses on the FFC form and in the letter of response prior to submission to the administering entity with the peer review working papers. What should be considered during that review?

Interpretation—

220.A8 The purpose of the firm’s response on the FFC form and in the letter of response is for a firm to stipulate, in writing, the specific

Highlighted section should be in section 320. Removed the remainder b/c covered in the requirements or N/A.

148



control. In a System Review, the description of the action(s) the firm has taken or will take should discuss remediation of findings and deficiencies in the system of quality control and nonconforming engagements, if applicable, to ensure prevention of recurrence of the finding, deficiency or significant deficiency. For System and Engagement Reviews, the action(s) should be feasible, genuine, and comprehensive, addressing each of the requirements in paragraphs .99 and .125. The FFC form and letter of response should not be used as a place to indicate justification for the firm’s actions that related to the deficiency or significant deficiency. If the firm’s response is not deemed to be comprehensive, genuine, and feasible, the technical reviewer or RAB will request a revised response.

In a System Review, a firm’s failure to appropriately remediate findings, deficiencies, and nonconforming engagements is a strong indicator of a tone at the top weakness and the team captain should consider whether a related deficiency is appropriate. Reviewers are reminded that firms are only required to remediate as appropriate in accordance with professional standards and are not expected to recall reports or perform additional procedures in every scenario. In general, if firms can articulate their consideration of the professional standards and why the actions taken or planned are deemed appropriate by the team captain, it would not result in a tone at the top deficiency. Firms are discouraged from defaulting to a response of “we’ll fix it on the next

action(s) that will be taken to correct findings, and deficiencies, and significant deficiencies noted by the reviewer and, on a System Review, to enhance the current system of quality control. In a System Review, the description of the action(s) the firm has taken or will take should discuss remediation of findings and deficiencies in the system of quality control and nonconforming engagements, if applicable, to ensure prevention of recurrence of the finding, deficiency or significant deficiency. For System and Engagement Reviews, the action(s) should be feasible, genuine, and comprehensive, addressing each of the requirements in paragraphs .99 and .125. The FFC form and letter of response should not be used as a place to indicate justification for the firm’s actions that related to the deficiency or significant deficiency. If the firm’s response is not deemed to be comprehensive, genuine, and feasible, the technical reviewer or RAB will request a revised response.

In a System Review, a firm’s failure to appropriately remediate findings, deficiencies, and nonconforming engagements is a strong indicator of a tone at the top weakness and the team captain should consider whether a related deficiency is appropriate. Reviewers are reminded that firms are only required to remediate as

149



engagement” without thought behind that response. It may be the appropriate response but firms should be able to articulate why that is the appropriate response.

If after consideration of the firm’s response, the team captain determines that there are other systemic issues such as tone at the top, he or she should not avoid addressing the issues, even if it puts the reviewer in an adversarial position. The team captain may consult with the administering entity or AICPA for support in how the issues should be addressed. Guidance on tone at the top and reporting examples within the Standards, Section 3100, Supplemental Guidance, and Section 4250, Guidance for Writing Deficiencies and Significant Deficiencies Included in System Review Reports, will assist the reviewer with supporting his or her conclusions. If a firm disagrees with the conclusions, the disagreement guidance in paragraph .93 and .116 of the Standards should be followed.

appropriate in accordance with professional standards and are not expected to recall reports or perform additional procedures in every scenario. In general, if firms can articulate their consideration of the professional standards and why the actions taken or planned are deemed appropriate by the team captain, it would not result in a tone at the top deficiency. Firms are discouraged from defaulting to a response of “we’ll fix it on the next engagement” without thought behind that response. It may be the appropriate response but firms should be able to articulate why that is the appropriate response.

If after consideration of the firm’s response, the team captain determines that there are other systemic issues such as tone at the top, he or she should not avoid addressing the issues, even if it puts the reviewer in an adversarial position. The team captain may consult with the administering entity or AICPA for support in how the issues should be addressed. Guidance on tone at the top and reporting examples within the Standards, Section 3100, Supplemental Guidance, and Section 4250, Guidance for Writing Deficiencies and Significant

150



Deficiencies Included in System Review Reports, will assist the reviewer with supporting his or her conclusions. If a firm disagrees with the conclusions, the disagreement guidance in paragraph .93 and .116 of the Standards should be followed.

Election to Have a System Review

103-1 Question—Paragraph .103 of the standards notes that firms eligible to have an Engagement Review may elect to have a System Review. What tailoring is required to the peer review report under these circumstances?

Interpretation—Under these circumstances, any references in the peer review report to “the accounting and auditing practice” should be tailored to refer only to “the accounting practice.” In addition, the following sentence should be added: “Firm XYZ & Co. has represented to us that the firm did not perform engagements that would require a system review.”

103-1 Question—Paragraph .103 of the standards notes that firms eligible to have an Engagement Review may elect to have a System Review. What tailoring is required to the peer review report under these circumstances?

Interpretation—Under these circumstances,

XXX.XX If a firm elects to have a System Review in accordance with par. .06, any references in the peer review report should be tailored as follows:

a. Any reference to “the accounting and auditing practice” should be tailored to refer only to “the accounting practice”.”; and

Should place in System Review, but referenced in 220 (I think)

151



a.b. In addition, the following sentence should be add the sentenceed: “Firm XYZ & Co. has represented to us that the firm did not perform engagements that would require a system review.”

Selecting a Preparation Engagement in an Engagement Review

104-1

Question—Must a peer reviewer select a preparation engagement in an Engagement Review?

Interpretation—No. A reviewer is not necessarily required to select a preparation engagement in an Engagement Review. If a reviewer is able to meet the requirements of paragraph .104 of the standards without selecting a preparation engagement, then a preparation engagement is not selected. However, if selecting a preparation engagement is the only way a reviewer can meet any of the following requirements (as outlined in paragraph .104 of the standards), then a preparation engagement (either with or without a disclaimer report) should be selected. These requirements are as follows:

• Ordinarily, at least two engagements should be selected for review.

Removed Duplicate of 220.08

152



• One engagement should be selected from each partner (or individual of the firm) responsible for the issuance of reports or performance of engagements.

• An engagement with disclosures (performed under SSARSs or SSAEs) should be selected.

• An engagement that omits substantially all disclosures (performed under SSARSs) should be selected.

104-2

Question—What should the peer reviewer be reviewing on a preparation engagement in an Engagement Review?

Interpretation—The reviewer would review the engagement letter as well as the legend on each page of the financial statements to determine that they comply with SSARSs. If the firm issues a disclaimer report, the reviewer would also assess whether it complied with SSARSs. In addition, the reviewer should also perform procedures to determine whether the presentation of the financial statements is appropriate and that the disclosures are adequate based on the applicable financial reporting framework. If substantially all disclosures are omitted, the reviewer would need to determine

removed This is covered in the checklists

153



whether the appropriate label is present for any disclosures that are made.

104-3

Question—Should the standard language in the peer review report be tailored on an Engagement Review, if preparation engagement(s) are selected for review?

Interpretation—No.

104-4

Question—What are some examples of when a preparation engagement should be selected during an Engagement Review?

Interpretation—

Example 1. If a sole practitioner performs compilation engagements with disclosures (or SSAEs, or reviews) and compilation engagements that omit substantially all disclosures, then one of each of these levels of service should be selected as part of the peer review. None of the firm’s preparation engagements should be selected.

Example 2. If a sole practitioner only performs compilation engagements with disclosures and preparation engagements that omit substantially all

Consider if these examples belong in a guide…

154



disclosures (and no other engagements under SSAEs or SSARSs), then one of each type of engagement should be selected as part of the peer review because an engagement that omits substantially all disclosures should be selected.

Example 3. If a sole practitioner only performs compilation engagements that omit substantially all disclosures and preparation engagements with disclosures (and no other engagements under the SSAEs or SSARSs), then one of each type of engagement should be selected as part of the peer review because a full disclosure engagement should be selected.

Example 4. If a sole practitioner only performs compilation engagements with disclosures and preparation engagements with disclosures, then two compilation engagements should be selected as the selection of a preparation engagement is not required to be and should not be selected to meet any of the criteria outlined in paragraph .104 of the standards. However, if the firm only performs one compilation engagement with disclosures (as well as preparation engagements with disclosures and no other engagements under SSAEs or SSARSs), the compilation engagement and a preparation engagement should be selected as part of the peer review. In this case, a preparation engagement is selected in order to meet the requirement of selecting a minimum of two engagements.

155



Example 5. Firm ABCDE is a five-partner firm and partner A performs agreed-upon procedure engagements, partner B performs review engagements, partner C performs full disclosure compilation engagements, partner D performs compilation engagements that omit substantially all disclosures and partner E performs preparation engagements. In this scenario one engagement is selected from each partner A, B, C and D which fulfills the requirement to select an engagement in each level of service outlined in paragraph .104a of the standards. However, because every person in the firm responsible for the issuance of financial statements must have an engagement selected, one of partner E’s preparation engagements should be selected. Because the requirement to select an engagement with disclosures and an engagement that omits substantially all disclosures has been met (through the selection of engagements performed by the other partners) any preparation engagement performed by partner E may be selected.

Example 6. Using the same facts described in example 5, if partner E also performed a review engagement and a compilation engagement that omits substantially all disclosures, either the review engagement or the compilation engagement should be selected. The reviewer should not select any of partner E’s preparation engagements unless one of the requirements listed in paragraph .104 of the standards cannot otherwise be met.

156



104-5

Question—What if the accountant is engaged to perform an engagement in accordance with SSARSs on financial information other than historical financial statements (for example, the preparation or compilation of prospective financial information or the compilation of pro forma financial information)?

Interpretation—References to financial statements for engagements performed in accordance with SSARS are to be taken as a reference to such other financial information. In accordance with SSARS, reviews of subject matter other than historical financial information are to be performed in accordance with Statements on Standards for Attestation Engagements.

Impact of SQCS No. 8 on Engagement Reviews

109-1

Question—Paragraph .109 of the standards notes that an Engagement Review does not include a review of other documentation prepared on the engagements submitted for review (other than the documentation referred to in paragraphs .107–.108), tests of the firm’s administrative or personnel files, interviews of selected firm personnel, or other

Consider where this would belong if anywhere.

157



procedures performed in a System Review. Should or may the review captain obtain or make inquiries regarding a firm’s written quality control policies and procedures during an Engagement Review? Would a firm’s failure to have its quality control policies and procedures documented result in an individual engagement being deemed not performed or reported on in conformity with applicable professional standards, even if there are no other matters, findings, or deficiencies noted on the engagement?

Interpretation—SQCS No. 8 states that firms should document their quality control policies and procedures and that the size, structure, and nature of the practice of the firm are important considerations in determining the extent of the documentation of established quality control policies and procedures.

However, the objective of an Engagement Review is to evaluate whether engagements submitted for review are performed and reported on in conformity with applicable professional standards in all material respects. An Engagement Review consists of reading the financial statements or information submitted by the reviewed firm and the accountant’s report thereon, together with certain background information and representations the applicable documentation required by professional standards. An Engagement Review does not provide the review captain with a basis for expressing any form of assurance on the firm’s system of quality control

158



(which is what the documentation requirements are related to).

Further, AR section 100 paragraph .72 states, “deficiencies in or instances of noncompliance with a firm’s quality control policies and procedures do not, in and of themselves, indicate that a particular review or compilation engagement was not performed in accordance with SSARS.” This is also consistent with the SSAEs (and SASs).

Therefore, if reading the firm’s documented quality control policies and procedures or the inability for the review captain to do so has no impact on whether the actual engagements submitted for review are performed and reported on in conformity with SSARS and the SSAEs in all material respects, reading the documented quality control policies and procedures would only appear to give a review captain the insight concerning the systemic cause concerning why a matter, finding, or deficiency occurred. Although this may be useful information in preparing MFCs or FFCs, the systemic reasons for these items are beyond the scope of an Engagement Review.

Therefore, obtaining or reviewing a firm’s documented quality control policies and procedures would not be applicable to Engagement Reviews.

Although the standards allow for “reading the applicable documentation required by professional

159



standards,” and the SQCSs are a part of professional standards, it might appear that the standards do not prohibit the reviewer from obtaining and reading the firm’s documented quality control policies and procedures; however, it is deemed as beyond the scope of an Engagement Review.

SQCS No. 8 also states that at least annually, the firm should obtain written confirmation of compliance with its policies and procedures on independence from all firm personnel required to be independent by the requirements set forth in the Independence topic (AICPA, Professional Standards, ET sec. 1.200) which includes the "Independence Rule" (AICPA, Professional Standards, ET sec. 1.200.001) and its related interpretations and the rules of state boards of accountancy and applicable regulatory agencies. Written confirmation may be in paper or electronic form. Analogous to the preceding situation, obtaining or reviewing a firm’s written independence confirmations would not be applicable to Engagement Reviews because the requirement is imbedded in the SQCSs and not a procedure required by SSARSs or the SSAEs.

160

Exhibit C

PRP SECTION 6200

MAPPING DOCUMENT



Introduction

.01 These materials have been developed based on the AICPA Standards for Performing and Reporting on Peer Reviews (the Peer Review Standards) and materials contained in the AICPA Peer Review Program Manual related to Engagement Reviews. (See Interpretation No. 6-1, “Compilations Performed When the Compiled Financial Statements Are Not Expected to Be Used by a Third Party (Management Use Only)” of paragraph .06 in section 1000, Standards for Performing and Reporting on Peer Reviews (sec. 2000, Peer Review Standards Interpretations, question 6-1) to the Peer Review Standards regarding compilation engagements when the compiled financial statements are not expected to be used by a third party (management use only), where no compilation report is issued).

Remove

.02 A firm that does not perform engagements under Statements on Auditing Standards or Government Auditing Standards, examinations under Statements

220.02 Refer to changes in Par. 1000.103

161



on Standards for Attestation Engagements (SSAEs) or engagements performed under PCAOB standards can have an Engagement Review; however, such firms may voluntarily elect to have a System Review. If a firm elects to have a System Review, refer to Interpretation No. 103-1 for an illustration of report modification.

.03 Information concerning the reviewed firm or any of its clients or personnel is confidential and cannot be disclosed to anyone not involved in carrying out the peer review or administering the peer review program.

Should be covered in 100 section Refer to changes in Par. 1000.20

Independence and Conflict of Interest

.04 Independence in fact and in appearance with respect to the reviewed firm must be maintained by the reviewing firm, review team members, and any other individuals who may participate in the review (See Interpretations No. 21-1–21-20 “Independence, Integrity, and Objectivity,” of paragraph .21 in section 1000, Standards for Performing and Reporting on Peer Reviews [sec. 2000, Peer Review Standards Interpretations, questions 21-1–21-20]).

Should be covered in 100 section Refer to changes in Par. 1000.21

162



The "Integrity and Objectivity Rule" and its interpretations (AICPA, Professional Standards, ET sec. 1.100.001), and the "Independence Rule" and its interpretations (AICPA, Professional Standards, ET sec. 1.200.001) of the AICPA Code of Professional Conduct do not specifically consider relationships between review teams, reviewed firms, and clients of reviewed firms. However, the concepts pertaining to independence embodied in the Code of Professional Conduct should be considered in making independence judgments. See section 1000 paragraphs .21–.22.

.05 A reviewing firm or a review team member should not have a conflict of interest with respect to the reviewed firm or to those clients of the reviewed firm who are the subject of engagements reviewed.

Should be covered in 100 section

Scope of Review

.06 The objective of an Engagement Review is to evaluate whether engagements submitted for review are performed and reported on in conformity with

220.04 Refer to changes in par. 1000.102

163



applicable professional standards in all material respects.

.07 The evaluation of each engagement submitted for review includes the following:

a. Consideration of the financial statements or information and the related accountant’s report on the engagements performed under SSARS and engagements performed under SSAEs.

b. Consideration of the documentation on the engagements performed via reviewing background and engagement profile information, representations made by the firm, and inquiries.

c. Review of all other documentation required by applicable professional standards on the engagements.

220.10 Refer to changes in par. 1000.108

.08 An Engagement Review does not include a review of other documentation prepared on the engagements submitted for review (other than the documentation previously referred to), tests of the firm’s

Refer to changes in par. 1000.109

164



administrative or personnel files, interviews of selected firm personnel, or other procedures performed in a System Review. Accordingly, an Engagement Review does not provide the review captain with a basis for expressing any form of assurance on the firm’s system of quality control for the firm’s accounting practice. The review captain’s report does indicate, however, whether anything came to the review captain’s attention that caused him or her to believe that the engagements submitted for review were not performed and reported on in conformity with applicable professional standards in all material respects. The review captain should promptly inform the firm when an engagement is not performed and/or reported on in conformity with applicable professional standards and remind the firm of its obligation under professional standards to take appropriate actions. See section 2000 of the Peer Review Standards regarding compilation engagements when the financial statements are not expected to be used by a third party (management use only) where no compilation report is issued.

Additionally the last sentence should be removed b/c no longer relavant.

Engagement Selection

.09 Prior to the review, the reviewer or the administering entity will ask the reviewed firm to provide

Refer to par. 1000.104 Additionally, the Engagement Summary Form is now in PRIMA

165



summarized information showing the number of the firm’s engagements performed under SSARS and engagements performed under the SSAEs, classified into industry categories. That information should be provided for each partner, or individual of the firm if not a partner, who is responsible for the issuance of reports on such engagements. The Engagement Summary Form that will be used for this purpose is located at paragraph 34 of section 6100, Instructions to Firms Having an Engagement Review.

.10 Reviewers should obtain written representations from the firm’s management as part of a peer review. The written representation should be addressed to the review captain (for example, “To John Smith, CPA” or on committee-appointed review team reviews where appropriate, it may be addressed “To the Review Captain”) and dated the same date as the peer review report.

.11 The firm is required to make specific representations as noted in paragraph .208, appendix B, “Considerations and Illustrations of Firm Representations.” Each representation must be included in the representation letter. The firm is not

This paragraph is a reiteration of the rep letter requirements. TBD what PR-C section.

166



prohibited from making additional representations, including indicating that a specific condition does not exist. The representations should be addressed to the review captain (for example, “To John Smith, CPA” or on committee appointed review team reviews where appropriate, it may be addressed “To the Review Captain”) and dated the same date as the report. The written representations should be presented on firm letterhead and signed by individual members of management whom the reviewer or the administering entity believes are responsible for and knowledgeable about, directly or through others in the firm, the matters covered in the representations, the firm, and its system of quality control (this should not be a firm signature). Such members of management normally include the managing partner and the partner in charge of the firm’s system of quality control. If a representation made by management is contradicted by other information obtained, the review captain should investigate the circumstances and consider the reliability of the representations made and any effect on the report.

.12 Either the reviewer or the administering entity should discuss with the reviewed firm the 12-month period to be covered by the review. The peer review year is the 12-month period ending 6 months prior to the

Should be covered in PR-C 100

167



peer review report due date. The peer review report due date is 3 years and 6 months after the firm’s last peer review year-end, or, in the initial year, is 18 months after a firm enrolled or should have enrolled in the AICPA Peer Review Program. See paragraphs .13–.19 of section 1000 for timing of the reviews. That period should ordinarily end 3 to 5 months prior to the performance of the review. Ordinarily, the year-end date should not change from one triennial review period to the next.

.13 Based on the summarized client information, the reviewer or the administering entity should select the number and types of engagements to be reviewed.

Reiteration of part of 1000.104

.14 The number of engagements selected should ordinarily adhere to the following guidelines for reviewers:

a. Select one engagement from each of the following levels of service performed by the firm:

1. Review of financial statements (performed under SSARS)


168



2. Compilation of financial statements with disclosures (performed under SSARS)

3. Compilation of financial statements that omits substantially all disclosures (performed under SSARS)




1. One preparation engagement with disclosures (performed under SSARS) should be selected when performed by an individual in the firm who does not perform any engagements included in item a or when the firm’s only engagements with disclosures are preparation engagements.

2. One preparation engagement that omits substantially all disclosures

169



(performed under SSARS) should be selected when performed by an individual in the firm who does not perform any engagements included in item a or when the firm’ only omit disclosures engagements are preparation engagements.


d. Ordinarily, at least two engagements should be selected for review.

.15 The preceding criteria are not mutually exclusive. The objective is to ensure that one engagement is selected for each partner and one engagement is selected from each of the areas of service performed by the firm listed in item a in the previous list. Therefore, one of every type of engagement that a partner, or individual of the firm if not a partner, responsible for the issuance of the reports listed in item a in the previous list performs does not have to be reviewed as long as, for the firm taken as a whole, all types of engagements noted in item a in the previous list performed by the firm are covered.


170



.16 Appendix A, "Applications of the Engagement Selection Guidelines," shows how the guidelines in this section can be applied to five sample firms.

Consider where examples should go. Also 2000.104-1 through -5.

.17 The types of engagements selected may also attempt to include clients operating in different industries.

220.A4 The types of eEngagements selectedion may also attempt to include clients operating in different consideration of industries.

.18 Within 30 days after the reviewer or the administering entity provides the firm with a description of the number and types of engagements to be reviewed, the firm should select the engagements in accordance with those specifications and submit the following information to the reviewer or the administering entity (as applicable) for each engagement:

a. A copy of the financial statements or information and the accountant’s report, specific background information, representations about each engagement, and the firm’s documentation required by applicable professional standards. The client’s name may be masked and assigned a

Evaluate the Engagement Questionnaire 6100 App. B. Similar to par. 1000.107 Evaluate the 30 day requirement

171



code number. The reviewed firm should keep a record of those code numbers to be able to respond to any questions by the reviewer.

b. A completed engagement questionnaire that includes engagements within the peer review year-end (section 6100 appendix B, “Engagement Questionnaire”).

.19 A firm may be dropped from the program if it has failed to have a review by the date assigned. Therefore, if a firm fails to provide the information described in paragraph .18 in sufficient time to enable the reviewer to complete the Engagement Review prior to the required due date, the reviewer should promptly advise the entity administering the review of this fact. Appropriate fair procedures will be followed in these circumstances.

Should be covered in a different section

.20 A firm whose peer review has not commenced may resign from the program by submitting a letter of resignation to the board. However, once a peer review commences, a firm will not be able to resign from the program except as stated in this paragraph. A peer review commences when the review team begins the review of engagements in an Engagement

Should be covered in a different section Similar to par. 2000.5g-1

172



Review. A firm will be permitted to resign once its peer review has commenced when the firm submits a letter pleading guilty, acknowledging its noncooperation with the program, waiving its right to a hearing, and for firms with AICPA members, agreeing to allow the AICPA to publish, in such form and manner as the AICPA Council may prescribe, the fact that the firm has resigned from the program before completion of its peer review, evidencing noncooperation with the program.

Performing the Review

.21 Engagement Reviews must be documented using the programs and checklists issued by the AICPA Peer Review Board (refer to Interpretation No. 24-1 in section 2000). These materials include a reviewer’s checklist (appendix B, “Checklist for Reviewing Drafts of Engagement Review Reports”), which serves as a program outlining procedures necessary to perform an Engagement Review.

PR-C 100.XX Similar to par. 2000.24-1. Notice this uses “must”

.22 The peer reviewer should utilize the applicable supplemental checklists contained in PRP 22,000, “Engagement Checklist Supplements—System

Need to consider

173



Reviews.” The supplemental checklists cover disclosure and financial presentation items that are unique to specific industries. The reviewer should complete the applicable supplemental checklist or document the reason(s) why he or she did not in the Review Captain’s Summary. For engagement reviews of compilation or preparation engagements that omit substantially all disclosures, the reviewer may choose to complete the supplemental checklist, but it is not required.

.23 Reviewers should discuss with the firm any allegations or investigations of deficiencies (including litigation) in the conduct of an accounting or attestation engagement performed and reported on by the firm, whether the matter relates to the firm or its personnel, within the three years preceding the firm’s current peer review year-end.

Similar to par. 1000.34 and part of firm reps 1000.208

.24 Reviewers should review the engagements submitted along with the background information provided. Questions and possible deficiencies noted during the review should be documented on Matter for Further Consideration (MFC) forms (section 6500, Instructions for Use of Matter for Further

Covered in 1000.113 essentially

174



Consideration [MFC] Form for Engagement Reviews) and Findings for Further Consideration (FFC) forms (section 6600, Instructions for Use of Finding for Further Consideration [FFC] Forms), if necessary, and discussed with the reviewed firm.

.25 Determining the relative importance of matters noted during the peer review, individually or combined with others, is a matter of professional judgment. Careful consideration is required in forming conclusions. The descriptions that follow, used in conjunction with practice aids (MFC, FFC, and Disposition of Matter for Further Consideration, forms) described as follows to document these items, are intended to assist in determining the nature of the peer review report to issue:

a. A matter is noted as a result of evaluating whether an engagement submitted for review was performed and/or reported on in conformity with applicable professional standards. The evaluation includes reviewing the financial statements or information, related accountant’s reports, and adequacy of procedures performed, including related documentation. Matters are typically one or more “No” answers to questions in peer


175



review questionnaire(s). A matter is documented on a MFC form.

b. A finding is one or more matters that the review captain has concluded result in financial statements or information, the related accountant’s reports submitted for review, or the procedures performed, including related documentation, not being performed and/or reported on in conformity with the requirements of applicable professional standards. A review captain will conclude whether one or more findings are a deficiency or significant deficiency. If the review captain concludes that no finding, individually or combined with others, rises to the level of deficiency or significant deficiency, then a report rating of pass is appropriate. A finding not rising to the level of a deficiency or significant deficiency is documented on a FFC form.

c. A deficiency is one or more findings that the review captain concludes are material to the understanding of the financial statements or information or related accountant’s reports, or both, or that represent omission of a critical procedure, including documentation, required by applicable professional standards. When a deficiency is noted, the review captain concludes that at least one but

176



not all engagements submitted for review were not performed and/or reported on in conformity with applicable professional standards in all material respects. When the review captain concludes that deficiencies are not evident on all of the engagements submitted for review, such deficiencies are communicated in a report with a peer review rating of pass with deficiencies.

d. A significant deficiency exists when the review captain concludes that deficiencies are evident on all of the engagements submitted for review. When a significant deficiency is noted, the review captain concludes that all engagements submitted for review were not performed and/or reported on in conformity with applicable professional standards in all material respects. Such significant deficiencies are communicated in a report with a peer review rating of fail.

177

Peer Review Program

178

Peer Review Board Open Session Meeting Materials Oct. 2018 · 1 AICPA Peer Review Board Open...

Documents

Transcript of Peer Review Board Open Session Meeting Materials Oct. 2018 · 1 AICPA Peer Review Board Open...