GAGAS Reports on Internal Control and Compliance: The Required Elements

The financial statement opinion is the part of a governmental audit that everyone reads. The report on internal control and compliance is the part the standards care about just as much. It is written whether or not anything went wrong, it has required content, and it carries findings that funders and oversight bodies act on. This guide lays out the requirements in Chapter 6 of Government Auditing Standards, 2024 revision (GAO-24-106786), with the paragraph numbers read from that document.

When the report is required

Paragraph 6.40 requires auditors to report on internal control and on compliance with provisions of laws, regulations, contracts or grant agreements regardless of whether they identify internal control deficiencies or instances of noncompliance. A clean audit still produces the report. In that case it says what was done and that nothing reportable was found.

Paragraph 6.41 adds that when providing an opinion or a disclaimer on the financial statements, auditors report as findings any significant deficiencies or material weaknesses in internal control over financial reporting that they identified from the work performed.

Paragraph 6.46 explains the purpose: GAGAS builds on the AICPA written-communication requirement so that users of the statements other than those charged with governance can see significant deficiencies and material weaknesses.

Paragraph 6.48 limits the period: when comparative statements are presented, the report on internal control and compliance relates only to the most recent reporting period included.

What the report must contain

Beyond the findings, Chapter 6 requires the following.

• Noncompliance and fraud (6.42). The report includes relevant information about noncompliance with laws, regulations, contracts or grant agreements that has a material effect on the financial statements or other financial data significant to the audit objectives, and about fraud that is material, quantitatively or qualitatively. This applies when the auditors, based on sufficient appropriate evidence, identify or suspect it.
• Scope of testing (6.43). The same report or a separate one describes the scope of the auditors' testing of internal control over financial reporting and of compliance. It also states whether the tests provided sufficient appropriate evidence to support opinions on the effectiveness of internal control and on compliance.
• Cross-references (6.44). If the auditors report separately, the financial statement audit report refers to the additional reports and states that they are an integral part of a GAGAS audit in considering internal control over financial reporting and compliance. Separate reports are made available to users in the same manner as the financial audit report.

Paragraph 6.43 matters for the wording of the report. The standard does not ask auditors to opine on internal control in a financial audit. It asks them to say what they tested and whether the tests were enough to support such an opinion.

Findings and their elements

Paragraph 6.17 requires auditors to plan and perform procedures to develop the criteria, condition, cause and effect of findings to the extent relevant and necessary to achieve the audit objectives. Paragraphs 6.25 to 6.28 define the elements:

• Criteria. The laws, regulations, contracts, grant agreements, standards, measures and benchmarks against which performance is evaluated. In a financial audit, the applicable financial reporting framework, such as GAAP, represents one set of criteria.
• Condition. A situation that exists, determined and documented during the audit.
• Cause. The factor or factors responsible for the difference between condition and criteria. Common causes include poorly designed policies, inconsistent or incomplete implementation, or factors beyond management's control.
• Effect or potential effect. The outcome or consequence of the difference.

Paragraph 6.18 requires auditors to consider internal control deficiencies when developing the cause element. Paragraph 6.29 notes that the cause of any finding may relate to underlying internal control deficiencies, and that depending on magnitude, likelihood and nature, a deficiency could be a significant deficiency or material weakness in a financial audit.

For presentation, paragraph 6.51 requires the elements to be developed to the extent needed to help officials understand the need for corrective action. Paragraph 6.52 requires findings to be put in perspective: describe the nature and extent of the issues and the work performed, relate instances to the population or number of cases examined, and quantify results in dollars or other measures. If results cannot be projected, conclusions are limited accordingly.

Waste and abuse

Under paragraph 6.20, auditors are not required to perform specific procedures to detect waste or abuse in financial audits, because the determinations are subjective, but they may consider whether and how to communicate them. Paragraph 6.21 defines waste as using or expending resources carelessly, extravagantly or to no purpose. Paragraph 6.23 defines abuse as behavior deficient or improper compared with what a prudent person would consider reasonable and necessary business practice, excluding fraud and noncompliance.

Less-than-material matters

Paragraph 6.45 requires written communication to audited entity officials when auditors identify or suspect noncompliance, or have evidence of fraud, with an effect on the financial statements or other financial data that is less than material but warrants the attention of those charged with governance. Paragraph 6.49 leaves the communication of other noncompliance, including clearly inconsequential instances, to professional judgment.

Views of responsible officials

Paragraph 6.58 requires auditors to obtain and report the views of responsible officials on the findings, conclusions and recommendations, along with planned corrective actions. If written comments are received, a copy or summary goes into the report (6.59). If comments are oral only, the auditors prepare a summary, give it to the officials to verify and include it. If the comments conflict with the findings, auditors evaluate their validity and either explain their disagreement in the report or modify the report (6.60). If officials refuse or cannot comment in a reasonable time, the auditors issue the report and say that no comments were provided (6.61).

Reporting directly to outside parties

Paragraph 6.54 sets two circumstances in which auditors report directly outside the entity.

1. Management fails to satisfy legal or regulatory requirements to report noncompliance or fraud to specified external parties. The auditors first tell those charged with governance, and if the entity still does not report as soon as practicable, the auditors report directly to the specified parties.
2. Management fails to take timely and appropriate steps in response to fraud or noncompliance that is likely to have a material effect on the subject matter and involves funding received directly or indirectly from a government agency. The auditors first report the failure to those charged with governance, and if management still does not act, report directly to the funding agency.

The duty survives resignation or dismissal (6.55). Auditors obtain sufficient appropriate evidence, such as confirmation from outside parties, to corroborate management's representation that it reported findings as required (6.56).

Worked example

Cobblestone Township's auditor tests a federally funded road grant. The township's procurement policy requires three quotes above $25,000. The auditor tests 15 purchases and finds that 4 lacked quotes, totaling $214,000, out of 38 purchases in the grant population totaling $1.9 million.

• Criteria. The township's written procurement policy and the grant's procurement terms.
• Condition. Four of 15 tested purchases, $214,000, were made without the required quotes.
• Cause. The purchasing clerk was unaware of the threshold, and the policy was not distributed after the last update.
• Effect. The grant costs may be questioned by the funding agency, and the township cannot show it obtained competitive prices.

Under 6.52, the finding states the 4-of-15 rate and the dollar value and limits its conclusions if the sample cannot be projected. The township clerk's written response and corrective plan appear in the report (6.58, 6.59). If the township had refused to report a legally required notification to the agency, 6.54 would send the auditor to those charged with governance first and then to the specified party.

Related reading

For the Single Audit layer that adds federal program reporting, see Single Audit walkthrough and the corrective action plan guide. For independence in the same standards, see GAGAS 2024 independence.

Where CORAA fits

CORAA prepares ready-to-review audit files for US CPA firms, including finding schedules with the four elements laid out for the reviewer. The firm keeps the client, the review and the signature. See /us.

Sources

• U.S. Government Accountability Office, Government Auditing Standards, 2024 Revision (GAO-24-106786), Chapter 6: https://www.gao.gov/assets/gao-24-106786.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error