The Lowdown on New Peer Review Regs
Taking the Mystery Out of the New Requirements
By Linda McCrone, CPA
California joined more than 40 other states and territories Jan. 1, 2010, in requiring mandatory peer review of firms that issue compilation, review, attest and audit reports through legislation sponsored by the California Board of Accountancy. Heres a primer on what that means for affected firms.
Who is Subject to Peer Review?
The first step is to determine whether the firm is issuing financial statements or a trial balance. If the firm is not issuing a financial statement, then its not required to issue a report and would not be subject to peer review.
For more, see SSARS standards, specifically the related interpretations of Sec. AR 100, question 15 [AR Sec. 9100.54].
If the firm is issuing financial statements, but only for management use of the client and not for third partiessuch as a bankSSARS Sec. AR 100.24 allows the firm to issue financial statements without a report.
To do so, there must be an engagement letter with the client with very specific wording, and each page of the financial statements must include a reference such as restricted for managements use only.
More details and a sample engagement letter are available in the standards.
A firm that produces financial statements for management use only can turn these statements over to another CPA firm to issue a compilation, review or audit. Under the related interpretations of Sec. AR 100, question 31 [AR Sec. 9100.136], although the other firm is a third party, its not deemed to be using the financial statements.
Although question 31 and the related answer address a situation where the other CPA firm is performing an audit, the question and answer also applies to compilation and review engagements.
Accountancy Regulations, Article 6, Sec. 42 excludes firms from peer review whose highest level of work is compilations where no report is issued.
CPA firms with employees acting as controllers or similar positions for clients shouldnt be issuing reports if they are part of the management of the client. Instead, they could issue a transmittal letter on the clients letterhead. See the related interpretations of Sec. AR 100, question 21 [AR Sec. 9100.80] for sample language. This type of engagement would not be subject to peer review.
When Does Peer Review Apply?
Firms will begin reporting peer review information to the CBA in summer 2011, even though the law is effective Jan. 1, 2010.
Accountancy Regulation Article 6, Sec. 45 has a three-year phase-in using the last two digits of a firm number [the firm number is the individuals license number for sole practitioners who are not incorporated]:
The CBA determines who will be subject to mandatory peer review. Since the statute went into effect Jan. 1, 2010, the CBA could determine that a firm issuing any compilation, review, audit or attest engagements with report dates after Jan. 1, 2010, is operating an accounting or auditing practice.
What is Peer Review?
A peer review, performed every three years by an independent CPA, comes in two types:
The peer reviewers report will have one of the following ratings:
For system reviews, the peer reviewer visits the firm, evaluates the system of quality control, interviews staff and reviews a representative sample of accounting and auditing engagements. Again, there are three ratings for the peer review report:
The peer reviewer submits the report, FFC and work papers to the peer review program. Technical reviewers, who sometimes ask questions or require changes, then review the peer review. Three or four members of the 20-member California Peer Review Committee then evaluate the peer review and decide whether to accept the peer review or require additional changes.
The CBA recognizes the AICPA Peer Review Program as meeting the requirements of their peer review regulations. The AICPA National Peer Review Committee administers peer reviews for firms that are required to register with and be inspected by the Public Company Accounting Oversight Board or firms that perform audits of non-SEC issuers pursuant to PCAOB standards.
CalCPA administers peer review for all other firms headquartered in California. Firms headquartered in other states, but also licensed in California, may use their AICPA approved administering entity to process their peer reviews.
How Does a Firm Get Started?
A firm should submit an enrollment form to the CalCPA Peer Review Program. Firms should begin this process in late summer or early fall before the year the firms peer review must be submitted to the CBA. Once the peer review is finished and submitted to CalCPA, processing time typically takes two to three months. Enrollment forms for AICPA member and non-member firms are available online.
When a firm enrolls, the system automatically assigns a due date, which complies with AICPA requirements but not necessarily to CBA requirements. It is the firms responsibility to make sure its peer review is completed in a timely manner.
CalCPAs peer review program is paperless, so its important that the firm include the correct e-mail address for the managing partner or owner on the enrollment form, and that the firm adds and to its e-mail safe senders list.
Choosing a Peer Review Year
One of the most important peer review decisions a firm makes is choosing the appropriate peer review year. Peer reviewers select engagements to review with periods or years ending within the peer review year.
Firms need to have completed most of their engagements by the time the peer review commences so the peer reviewer will be able to select appropriate engagements. This is why firms are assigned a due date six months after their peer review year-end.
The peer reviewer must submit the peer review work papers to the administering entity by the due date.
In subsequent peer reviews, the administering entity will contact the firm to start the peer review process in the month of a firms year-end. The firm could start and complete the process during the summer, since most Dec. 31 engagements would be completed by then, and avoid having to work on peer review during the early- and late-year tax seasons.
Performing the review in the summer would also allow plenty of time for the peer review to go through the administrative process.
The determination of year-end for system reviews will depend on the nature of a firms audit practice. For example, if the firm performs ERISA audits, these are generally calendar year audits due by Oct. 15. A good year-end would be June 30, with the peer review occurring in November or December.
Firms performing nonprofit or government audits often have engagements with June 30 year-ends that sometimes run into the following year to complete. A good year-end may be April 30 or May 31, so the firms prior year audits could be reviewed during the summer before the start of audit season.
Choosing a Peer Reviewer
Another important decision is choosing the firms peer reviewer. You can review the AICPAs criteria for a CPA to become a peer reviewer online.
For engagement peer reviews, peer reviewers do not have to match the firms industry. For system reviews, there must be a match of certain audit industries. For some industries or practice areas there must be a match if the firm performs any of that type of audit, but for other industries, there must be a match only if the audits comprise more than 10 percent of the firms audit practice.
In system reviews, peer reviewers can use team members to assure the match. Its important to remember that only audits need to match.
To find a peer reviewer, ask other firms for opinions about their peer reviewers. CalCPA also offers an annual directory of reviewers available online. Peer reviewers pay a small fee to be included in this directory.
The AICPA also has an online directory of all reviewers.
In addition, some firms are hiring a consultant to either review some engagements for a period prior to their peer review year or to become part of their pre-issuance review process. The consultant is also a good resource to assist you in finding a peer reviewer.
How Much Will Peer Review Cost?
The firm will pay the peer reviewer a negotiated fee. Engagement reviews typically take three to six hours. For engagement reviews, CalCPA offers a program known as Committee-Appointed Review Team, where the firm contracts with CalCPA, which uses independent contractors to perform the review. System reviews for firms that have just a few audits will typically take 12 to 20 hours.
The California Peer Review program charges an annual registration fee. Firms pay this fee every year, not just in the year of their peer review. Even though the program is part of CalCPA, it maintains separate financial statements to ensure that revenue covers expenses.
The California Peer Review Committee evaluates these financial statements annually to determine if the registration fee to be charged in the following year is appropriate.
For calendar year 2010, the fee is $175 for the first professional and $50 for each professional up to a maximum fee of $2,000. A professional is defined as a CPA or college graduate pursuing CPA licensure. This applies to all members of the firm that fit the definition of a professional, even if they perform no accounting or auditing work or are not full-time employees.
Quality Control Standards
Even though quality control documentation is only evaluated in system peer reviews, it is important to realize that all firmsnot just those with AICPA membersperforming accounting engagements must have a written quality control document and perform and document monitoring.
The AICPA offers a practice aid that provides sample wording for quality control documents for different size firms online. Alternatively, some firms are using the quality control policies and procedures documentation questionnaire available on the AICPAs website.
All firms are required to include the criteria established for an engagement quality control review [EQCR] of an engagement in their quality control document. Firms must be careful in developing EQCR criteria since some will need to hire an independent contractor to perform this service. Firms are allowed to set criteria so that it is probable the conditions will never be met.
For example, for firms that perform only reviews and compilations, the criteria could be that they will require an EQCR if they accept an audit engagement. For firms with audit practices, the criteria could be that an EQCR is required if the firm performs an Employee Benefit Plan audit or OMB Circular A-133 audit.
Other criteria might involve application of new standards, complex issues, size of client [in terms of amount of revenues], size of engagement [in terms of number of hours] or entry into a new industry.
Quality control standards also require an annual written independence confirmation. While this may be handled on an engagement-by-engagement basis, it is often more efficient to obtain such a confirmation from all firm personnel, including firm owners, to cover all firm clients.
Also, dont forget to obtain independence confirmations from per diem personnel or firms that perform a segment of an engagement.
Common Deficiencies
The most common deficiency in an engagement peer review is the misclassification of a material asset or liability. For example, the current portion of long-term debt is not recorded in current liabilities and the amount is material. If the amount is not material, this would be an FFC and not in the peer review report.
Also, when generally accepted accounting principles statements are issued, if a balance sheet and income statement are present, there must be a statement of cash flows for each period presented in the income statement. If the client does not want to pay for all the required statements of cash flow, simply modify the accountants report for the GAAP departure.
Statements of cash flow are not required if the financial statements are prepared on the cash or tax basis, but they must follow the GAAP rules if presented.
If financial statements contain a material departure from the basis of accounting used, the accountants report should be modified to describe the nature of the departure and the effect on the financial statements or that the effect is not known. A material departure cannot just be described in the notes. The financial statement and notes are the work product of the client, while the report is the work product of the CPA.
Some industries, such as construction and common interest realty associations, have additional accounting requirements that are explained in AICPA Audit and Accounting Guides. You can review the list online to determine if any industries that the firm issues financial statements for are covered by these guides.
For example, financial statements for common interest realty associations must have required supplementary information on future major repairs and replacements, or the report must describe the departure. This would apply even if the financial statement were a compilation without disclosure.
The standard report on a compilation without disclosure just describes the omitted note disclosures, not the missing required supplementary information, so an additional paragraph would need to be added to the report.
In system reviews, audits of employee benefit plans and audits under Government Auditing Standards or OMB Circular A-133 have unique auditing, reporting and financial statement issues. The AICPA has developed audit quality control centers for these industries that have resources.
Some of the resources are available to all firms, but other information is available only to members of these quality control centers.
Firms with membership in any of the quality control centers must have their peer review report in public file, but the FFCs are not part of this public file.
Linda McCrone, CPA, Esq. is CalCPAs director of technical services.
Peer Review Resources
CalCPA
CBA
Accountancy Act, Article 4, Sec. 5076; Accountancy Regulations, Article 6
AICPA:
CPA firms have undergone approximately 300,000 peer reviews since 1987, resulting in reports that provide insight into participating firms quality control standards and their real-world use of those standards. Peer review focuses on strengthening firms quality control and encourages firms to improve processes and correct shortcomings. Many firms also find peer review very educational and beneficial to their accounting and auditing practices.
Back to News
By Linda McCrone, CPA
California joined more than 40 other states and territories Jan. 1, 2010, in requiring mandatory peer review of firms that issue compilation, review, attest and audit reports through legislation sponsored by the California Board of Accountancy. Heres a primer on what that means for affected firms.
Who is Subject to Peer Review?
The first step is to determine whether the firm is issuing financial statements or a trial balance. If the firm is not issuing a financial statement, then its not required to issue a report and would not be subject to peer review.
For more, see SSARS standards, specifically the related interpretations of Sec. AR 100, question 15 [AR Sec. 9100.54].
If the firm is issuing financial statements, but only for management use of the client and not for third partiessuch as a bankSSARS Sec. AR 100.24 allows the firm to issue financial statements without a report.
To do so, there must be an engagement letter with the client with very specific wording, and each page of the financial statements must include a reference such as restricted for managements use only.
More details and a sample engagement letter are available in the standards.
A firm that produces financial statements for management use only can turn these statements over to another CPA firm to issue a compilation, review or audit. Under the related interpretations of Sec. AR 100, question 31 [AR Sec. 9100.136], although the other firm is a third party, its not deemed to be using the financial statements.
Although question 31 and the related answer address a situation where the other CPA firm is performing an audit, the question and answer also applies to compilation and review engagements.
Accountancy Regulations, Article 6, Sec. 42 excludes firms from peer review whose highest level of work is compilations where no report is issued.
CPA firms with employees acting as controllers or similar positions for clients shouldnt be issuing reports if they are part of the management of the client. Instead, they could issue a transmittal letter on the clients letterhead. See the related interpretations of Sec. AR 100, question 21 [AR Sec. 9100.80] for sample language. This type of engagement would not be subject to peer review.
When Does Peer Review Apply?
Firms will begin reporting peer review information to the CBA in summer 2011, even though the law is effective Jan. 1, 2010.
Accountancy Regulation Article 6, Sec. 45 has a three-year phase-in using the last two digits of a firm number [the firm number is the individuals license number for sole practitioners who are not incorporated]:
- Firm numbers ending in 01-33: reporting date is no later than July 1, 2011
- Firm numbers ending in 34-66, reporting date is no later than July 1, 2012
- Firm numbers ending in 67-00, reporting date is no later than July 1, 2013
The CBA determines who will be subject to mandatory peer review. Since the statute went into effect Jan. 1, 2010, the CBA could determine that a firm issuing any compilation, review, audit or attest engagements with report dates after Jan. 1, 2010, is operating an accounting or auditing practice.
What is Peer Review?
A peer review, performed every three years by an independent CPA, comes in two types:
- System Reviews: for firms that perform audits or examinations of prospective financial statements under the Statements on Standards for Attestation Engagements [SSAEs]
- Engagement Reviews: for firms that only issue compilations, reviews and reports under the SSAEs that are not included in system reviews.
The peer reviewers report will have one of the following ratings:
- Pass: Nothing came up during the review that caused the peer reviewer to believe that the engagements submitted for review were not performed and reported on in conformity with professional standards.
- Pass with deficiency: The peer reviewer found a material deficiency in one or more of the engagements submitted.
- Fail: Material deficiencies were found in all of the engagements submitted.
For system reviews, the peer reviewer visits the firm, evaluates the system of quality control, interviews staff and reviews a representative sample of accounting and auditing engagements. Again, there are three ratings for the peer review report:
- Pass: The firms system is suitably designed and the firm has complied with its policies and procedures so that it has a reasonable assurance of performing and reporting in conformity with applicable professional standards.
- Pass with deficiency: The system is suitably designed and the firm has complied with the system, except for the deficiency or deficiencies described in the report.
- Fail: The system is not suitably designed or has not been complied with.
The peer reviewer submits the report, FFC and work papers to the peer review program. Technical reviewers, who sometimes ask questions or require changes, then review the peer review. Three or four members of the 20-member California Peer Review Committee then evaluate the peer review and decide whether to accept the peer review or require additional changes.
The CBA recognizes the AICPA Peer Review Program as meeting the requirements of their peer review regulations. The AICPA National Peer Review Committee administers peer reviews for firms that are required to register with and be inspected by the Public Company Accounting Oversight Board or firms that perform audits of non-SEC issuers pursuant to PCAOB standards.
CalCPA administers peer review for all other firms headquartered in California. Firms headquartered in other states, but also licensed in California, may use their AICPA approved administering entity to process their peer reviews.
How Does a Firm Get Started?
A firm should submit an enrollment form to the CalCPA Peer Review Program. Firms should begin this process in late summer or early fall before the year the firms peer review must be submitted to the CBA. Once the peer review is finished and submitted to CalCPA, processing time typically takes two to three months. Enrollment forms for AICPA member and non-member firms are available online.
When a firm enrolls, the system automatically assigns a due date, which complies with AICPA requirements but not necessarily to CBA requirements. It is the firms responsibility to make sure its peer review is completed in a timely manner.
CalCPAs peer review program is paperless, so its important that the firm include the correct e-mail address for the managing partner or owner on the enrollment form, and that the firm adds and to its e-mail safe senders list.
Choosing a Peer Review Year
One of the most important peer review decisions a firm makes is choosing the appropriate peer review year. Peer reviewers select engagements to review with periods or years ending within the peer review year.
Firms need to have completed most of their engagements by the time the peer review commences so the peer reviewer will be able to select appropriate engagements. This is why firms are assigned a due date six months after their peer review year-end.
The peer reviewer must submit the peer review work papers to the administering entity by the due date.
In subsequent peer reviews, the administering entity will contact the firm to start the peer review process in the month of a firms year-end. The firm could start and complete the process during the summer, since most Dec. 31 engagements would be completed by then, and avoid having to work on peer review during the early- and late-year tax seasons.
Performing the review in the summer would also allow plenty of time for the peer review to go through the administrative process.
The determination of year-end for system reviews will depend on the nature of a firms audit practice. For example, if the firm performs ERISA audits, these are generally calendar year audits due by Oct. 15. A good year-end would be June 30, with the peer review occurring in November or December.
Firms performing nonprofit or government audits often have engagements with June 30 year-ends that sometimes run into the following year to complete. A good year-end may be April 30 or May 31, so the firms prior year audits could be reviewed during the summer before the start of audit season.
Choosing a Peer Reviewer
Another important decision is choosing the firms peer reviewer. You can review the AICPAs criteria for a CPA to become a peer reviewer online.
For engagement peer reviews, peer reviewers do not have to match the firms industry. For system reviews, there must be a match of certain audit industries. For some industries or practice areas there must be a match if the firm performs any of that type of audit, but for other industries, there must be a match only if the audits comprise more than 10 percent of the firms audit practice.
In system reviews, peer reviewers can use team members to assure the match. Its important to remember that only audits need to match.
To find a peer reviewer, ask other firms for opinions about their peer reviewers. CalCPA also offers an annual directory of reviewers available online. Peer reviewers pay a small fee to be included in this directory.
The AICPA also has an online directory of all reviewers.
In addition, some firms are hiring a consultant to either review some engagements for a period prior to their peer review year or to become part of their pre-issuance review process. The consultant is also a good resource to assist you in finding a peer reviewer.
How Much Will Peer Review Cost?
The firm will pay the peer reviewer a negotiated fee. Engagement reviews typically take three to six hours. For engagement reviews, CalCPA offers a program known as Committee-Appointed Review Team, where the firm contracts with CalCPA, which uses independent contractors to perform the review. System reviews for firms that have just a few audits will typically take 12 to 20 hours.
The California Peer Review program charges an annual registration fee. Firms pay this fee every year, not just in the year of their peer review. Even though the program is part of CalCPA, it maintains separate financial statements to ensure that revenue covers expenses.
The California Peer Review Committee evaluates these financial statements annually to determine if the registration fee to be charged in the following year is appropriate.
For calendar year 2010, the fee is $175 for the first professional and $50 for each professional up to a maximum fee of $2,000. A professional is defined as a CPA or college graduate pursuing CPA licensure. This applies to all members of the firm that fit the definition of a professional, even if they perform no accounting or auditing work or are not full-time employees.
Quality Control Standards
Even though quality control documentation is only evaluated in system peer reviews, it is important to realize that all firmsnot just those with AICPA membersperforming accounting engagements must have a written quality control document and perform and document monitoring.
The AICPA offers a practice aid that provides sample wording for quality control documents for different size firms online. Alternatively, some firms are using the quality control policies and procedures documentation questionnaire available on the AICPAs website.
All firms are required to include the criteria established for an engagement quality control review [EQCR] of an engagement in their quality control document. Firms must be careful in developing EQCR criteria since some will need to hire an independent contractor to perform this service. Firms are allowed to set criteria so that it is probable the conditions will never be met.
For example, for firms that perform only reviews and compilations, the criteria could be that they will require an EQCR if they accept an audit engagement. For firms with audit practices, the criteria could be that an EQCR is required if the firm performs an Employee Benefit Plan audit or OMB Circular A-133 audit.
Other criteria might involve application of new standards, complex issues, size of client [in terms of amount of revenues], size of engagement [in terms of number of hours] or entry into a new industry.
Quality control standards also require an annual written independence confirmation. While this may be handled on an engagement-by-engagement basis, it is often more efficient to obtain such a confirmation from all firm personnel, including firm owners, to cover all firm clients.
Also, dont forget to obtain independence confirmations from per diem personnel or firms that perform a segment of an engagement.
Common Deficiencies
The most common deficiency in an engagement peer review is the misclassification of a material asset or liability. For example, the current portion of long-term debt is not recorded in current liabilities and the amount is material. If the amount is not material, this would be an FFC and not in the peer review report.
Also, when generally accepted accounting principles statements are issued, if a balance sheet and income statement are present, there must be a statement of cash flows for each period presented in the income statement. If the client does not want to pay for all the required statements of cash flow, simply modify the accountants report for the GAAP departure.
Statements of cash flow are not required if the financial statements are prepared on the cash or tax basis, but they must follow the GAAP rules if presented.
If financial statements contain a material departure from the basis of accounting used, the accountants report should be modified to describe the nature of the departure and the effect on the financial statements or that the effect is not known. A material departure cannot just be described in the notes. The financial statement and notes are the work product of the client, while the report is the work product of the CPA.
Some industries, such as construction and common interest realty associations, have additional accounting requirements that are explained in AICPA Audit and Accounting Guides. You can review the list online to determine if any industries that the firm issues financial statements for are covered by these guides.
For example, financial statements for common interest realty associations must have required supplementary information on future major repairs and replacements, or the report must describe the departure. This would apply even if the financial statement were a compilation without disclosure.
The standard report on a compilation without disclosure just describes the omitted note disclosures, not the missing required supplementary information, so an additional paragraph would need to be added to the report.
In system reviews, audits of employee benefit plans and audits under Government Auditing Standards or OMB Circular A-133 have unique auditing, reporting and financial statement issues. The AICPA has developed audit quality control centers for these industries that have resources.
Some of the resources are available to all firms, but other information is available only to members of these quality control centers.
Firms with membership in any of the quality control centers must have their peer review report in public file, but the FFCs are not part of this public file.
Linda McCrone, CPA, Esq. is CalCPAs director of technical services.
Peer Review Resources
CalCPA
CBA
Accountancy Act, Article 4, Sec. 5076; Accountancy Regulations, Article 6
AICPA:
- Statements on Auditing Standards [SASs]
- Statements on Standards for Accounting and Review Services [SSARS]
- Statements on Standards for Attestation Engagements [SSAEs]
CPA firms have undergone approximately 300,000 peer reviews since 1987, resulting in reports that provide insight into participating firms quality control standards and their real-world use of those standards. Peer review focuses on strengthening firms quality control and encourages firms to improve processes and correct shortcomings. Many firms also find peer review very educational and beneficial to their accounting and auditing practices.