Many CPA firms that audit small governments, school districts and nonprofits also help those clients with their books. The firm drafts the financial statements, converts cash records to accrual, or reconciles accounts, because the client has one part-time bookkeeper. Under Government Auditing Standards, Chapter 3 applies its own tests, and some of the usual help is an impairment. This guide walks through the chapter as published in GAO-24-106786 and applies it to a typical engagement. The 2024 revision is effective for financial audits, attestation engagements and reviews of financial statements for periods beginning on or after December 15, 2025.
What independence means under GAGAS
Paragraph 3.21 defines independence as two things: independence of mind, the state of mind that permits an engagement without being affected by influences that compromise professional judgment, and independence in appearance, the absence of circumstances that would cause a reasonable and informed third party to conclude that the integrity, objectivity or professional skepticism of the audit organization or a team member had been compromised.
Paragraph 3.23 sets the period of professional engagement. It begins when the auditors sign an initial engagement letter or other agreement, or begin the engagement, whichever is earlier, and ends with notification of termination or the issuance of a report, whichever is later. For recurring engagements, the period does not stop and restart each year.
The conceptual framework and seven threats
Paragraph 3.27 requires auditors to apply the conceptual framework at the audit organization, engagement team and individual auditor levels. Paragraph 3.30 lists the broad categories of threats to evaluate:
- Self-interest. A financial or other interest will inappropriately influence judgment or behavior.
- Self-review. The auditor who provided nonaudit services will not appropriately evaluate the results of previous judgments or services.
- Bias. Political, ideological, social or other convictions lead to a position that is not objective.
- Familiarity. A close or long relationship with management or personnel, or with a family member, leads to a position that is not objective.
- Undue influence. Pressures from sources external to the audit organization affect objective judgments.
- Management participation. The auditor takes on the role of management or performs management functions for the audited entity.
- Structural. The placement of a government audit organization within a government entity affects its ability to work and report objectively.
Auditors determine whether threats are at an acceptable level (3.31) and, if not, whether safeguards can reduce them (3.32). Threats and safeguards are documented (3.33).
Nonaudit services: the gate
Before agreeing to a nonaudit service, paragraph 3.64 requires auditors to determine whether the service would create a threat to independence, alone or in aggregate with other nonaudit services, for any GAGAS engagement they conduct.
For financial audits, a nonaudit service otherwise prohibited by GAGAS and provided during the period covered by the financial statements may not threaten independence if the service was provided before the period of professional engagement, related only to periods before the period covered by the financial statements, and the statements for the period the service did relate to were audited by other auditors (3.67).
Nonaudit services can affect independence in later periods too. Paragraph 3.68 gives the example of an accounting and financial reporting system designed and implemented by the auditors and expected to stay in place for many years.
Management responsibilities
If management asked for the nonaudit service and it could create a threat, paragraph 3.73 requires the auditor to determine that the entity has designated an individual with suitable skill, knowledge or experience who understands the service well enough to oversee it. Paragraph 3.74 requires documentation of that consideration. If the entity is unable or unwilling to assume the responsibility, the auditors conclude the service impairs independence (3.75).
Paragraph 3.76 has the auditor obtain agreement from management that it assumes all management responsibilities, oversees the service through a designated individual, evaluates the adequacy and results of the service and accepts responsibility for the results. Paragraph 3.77 requires the auditor to document the understanding on objectives, services, the entity's responsibilities, the auditor's responsibilities and any limitations.
Paragraph 3.78 is unqualified: management responsibilities performed by auditors are impairments, because the management participation threat is so significant that no safeguards could reduce it. Paragraph 3.81 lists them, including setting policies and strategic direction, having custody of assets, accepting responsibility for designing, implementing or maintaining internal control, and serving as a voting member of a management committee or board.
Preparing accounting records and financial statements
This is where GAGAS departs most from the help a small firm usually gives. Three tiers apply.
Impairments (3.87). Services that impair independence include determining or changing journal entries, account codes or classifications, or other accounting records without management's approval; authorizing or approving transactions; and preparing or changing source documents without management approval.
Significant threats (3.88). Preparing financial statements in their entirety from a client-provided trial balance or underlying accounting records creates significant threats. The auditor documents the threats and the safeguards that eliminate or reduce them to an acceptable level, or declines the service.
Other threats (3.89). Other services in this area are still identified as threats and evaluated. They include recording transactions for which management has determined the classification, preparing certain line items or sections of the statements from the trial balance, posting entries that management has approved and preparing account reconciliations that identify reconciling items for management's evaluation. The auditor evaluates the significance and documents it (3.90). Relevant factors are the effect on the financial statements, the degree of subjectivity and how far the entity is involved in the significant judgments (3.94).
Paragraph 3.91 states the principle: management is responsible for the preparation and fair presentation of the financial statements even if the auditor helped draft them, and an auditor who accepts that responsibility for statements the auditor will audit impairs independence. Clerical help such as typing, formatting, printing and binding is unlikely to be a significant threat (3.95).
Under paragraph 3.70, routine advice during an engagement is not a nonaudit service, but financial statement preparation, cash-to-accrual conversions and reconciliations are, and are evaluated under the framework.
Other services that impair
Paragraph 3.97 concludes that providing or supervising ongoing monitoring procedures over internal control impairs independence. Paragraph 3.102 concludes that IT services relating to the period under audit impair independence when they include designing or developing a financial information system or other IT system that will play a significant role in managing an area of operations that is or will be the subject matter of an engagement. Paragraph 3.104 concludes that appraisal, valuation or actuarial services impair independence when they involve a significant degree of subjectivity and their results are material to the statements.
Worked example
Larkspur County Water District has an annual budget of $9 million, a part-time finance director and one finance clerk. Its audit firm proposes three services for the same year as the audit.
| Request | GAGAS treatment | Result |
|---|---|---|
| Draft the full financial statements and notes from the district's closed trial balance | 3.88: significant threats | Decline, or document threats and safeguards such as a separate reviewer outside the engagement team |
| Convert the clerk's cash-basis ledger to accrual and book the entries without management approving them | 3.70 says conversions are nonaudit services; booking entries without management approval is 3.87 | Impairment as proposed |
| Print and bind the statements | 3.95: unlikely to be a significant threat | Acceptable |
For the first request, the firm requires the board to name its finance director as the overseer (3.73) and obtains the management agreement described in 3.76. The firm also assigns a separate partner outside the engagement team to review the engagement and the nonaudit work, a safeguard that 3.69 lists as an example. The engagement letter sets out the 3.77 items. The second request is restructured: the clerk's contractor converts the ledger, and management reviews and approves every entry before the firm sees it.
What the file should hold
- The independence evaluation at acceptance and at each planning stage, covering the 3.30 threats.
- For each nonaudit service: the 3.64 determination, the 3.74 evaluation of management's ability, the 3.77 understanding and the 3.90 significance evaluation.
- The safeguards applied and who performed them.
- A list of services with the paragraph that governs each.
Related reading
For how the Yellow Book sits beside other audit types, see financial audit vs single audit vs Yellow Book audit and the 2024 Yellow Book revision. For the AICPA rules the firm also meets, see independence and nonattest services for small firms.
Where CORAA fits
CORAA prepares ready-to-review audit files for US CPA firms. The firm keeps the client, the review and the signature, and keeps its own independence determinations. See /us.
Sources
- U.S. Government Accountability Office, Government Auditing Standards, 2024 Revision (GAO-24-106786), Chapter 3: https://www.gao.gov/assets/gao-24-106786.pdf
Part of CORAA University · Government, single audit and nonprofits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error