<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=187647285171376&amp;ev=PageView&amp;noscript=1">

SAS 136 - Audit Report Update

Published by Summit Marketing Team on Apr 6, 2020 6:00:00 AM

The 401(k) Audit CPA Success Show: Episode 6

In this episode, Jamie Nau sits down with Kim Moore, the Summit CPA audit director to discuss a new audit standard that will be approved for the upcoming year. SAS (Statement on Audit Standards) number 136 makes some changes to the audit opinion letter that gets issued to you by the auditor. Most auditors are already complying with these new regulations, but if you don’t do a lot of audits, there may be some changes that you need to make.

So in this episode, we will go through everything you need to know as a plan sponsor once this new standard is implemented.

Jamie Nau: Hello and welcome to today's episode. Once again we are joined by Kim Moore, Director of Auditing, at Summit CPA. We are going to talk about a new audit standard that isn't quite approved, but will be approved for the upcoming year. So we want to make sure we get this out there, and people are aware of it. So, Kim, I'll let you give me the fancy name of the audit standard, and then kind of go into some of the details. 

Kim Moore: Welcome everyone. I know this is everybody's favorite topic, new audit standards coming out, but we're going to try to make this as interesting as we can as we talk about it today. The new standard is called SAS, which stands for Statement on Audit Standards Number 136. They are numbered in order of their being approved, or being proposed, and then approved. The standard number 136, the official title of it is, forming an opinion, and reporting on financial statements of employer benefit plans subject to a ERISA. So big name, which is pretty typical for an audit standard legal type document. So no surprises there. The thing to kind of take away from the title, and what's changing, is the audit opinion letter. That is a very important part of every audit that gets done for a benefit plan. So this this affects any benefit plan that is subject to ERISA that obviously needs an audit. It will change the actual letter that your auditor issues back to you.

Jamie Nau: So that is that in a couple of words. That's all. That's all it is, and you could just end the podcast here [laughing]

Kim Moore: Yeah, I wish that was the case. I think we all wish that was the case, unfortunately, audit standards usually have bigger implications than that. It actually is going to change the entire letter. Some of it is more like you just mentioned. It is changing the order of items in the letter. It is changing some verbiage. So definitely that's a part of it. We won't go into all those details today because we would put everybody to sleep. But it does change a couple of very important things. One is that it enumerates the items that the auditor is giving an opinion on. So it's going to spell out the work that was done as part of the audit. Now, in theory, all of that work should have been done in the past. And here at Summit, we have looked at this standard and all of the detailed guidance isn't out yet. But as we've gone through what is available, we believe that we're already complying with all of the required items that are going to be enumerated in the upcoming reports. But not all audit firms will be. So that is something that as a plan sponsor, you want to, not necessarily dig in to the audit standard, because it's been a pretty long document and if you're not an auditor, it might not make a lot of sense, and it would certainly be a lot of work for you. But I would suggest talk to your auditor and ask them. Are they doing all of the things that are going to be coming up in the new standard already? If they're not, you know, what are their plans to incorporate those items that they're not covering? What do you think that's going to mean in terms of the timing of the audit, the time it takes to complete the audit? What is it going to mean for me as the plan sponsor, or am I going to have to dig out a whole bunch of additional documents? I already have to give you a whole bunch of information. So what does that mean to me? So that's the first part of it.

Jamie Nau: So I know we've talked about this before, but, you know, we do a lot of 401(k) audits. It's really the only type of audit we do. But some companies that do 401(k) audits, they only do one or two 401(k) audits, they do some for their other clients, or they'll do a handful of them. So this standard may change those companies, it might not be worth it anymore.

Kim Moore: That's right. That's what we're anticipating may happen. As you mentioned, Jamie, if your auditor does a lot of audits, they're probably just like, we are on top of this. They've been monitoring it. This isn't you know, just issued, and nobody had a heads up on this. It’s been coming for a while, and those of us that are in this business have known. We've been watching it. But if your firm doesn't do many of these audits, maybe they're very busy with year-end work, or tax work, that's kind of where their focus has been, they may not even know this is coming. They may not find out until late in the day. For one thing, it may give them a lot of additional work that they don't really want to do, or want to take on. They may, as you mentioned, just look at this and say you know, this is way more depth than I want to get into. I don't really even understand some of these things that I'm going to have to give an opinion on. So they may choose to get out of the 401(k) business altogether. So I guess from a plan sponsor perspective, get with your auditor A.S.A.P. and ask them, do they know about this? What are their plans? You know, have they already started looking at it? If they're not informed about it, or  they can't really talk, they don't want to talk about it, or they say oh, I didn't know about that, let me look at it. You'll know as you talk to them whether they're looking at it, whether they're aware of it. If they're already working on it then maybe it's not so much of a concern. If you get a response where you know they don't know about it, or they haven't looked at it yet or they will worry about that later, I think those are all clues that as a plan sponsor you need to make sure you stay on top of it. The last thing you want to happen is you get late in the year and you're getting closer to the due date and then your auditor is looking at it and then they decide, oh, now I see what you're talking about. I don't want to do it. Now you're scrambling as a plan sponsor to try to find an auditor to get the audit done in in time. While we mention that, let's talk about the timing. This goes into effect for periods that end on, or after, December 15, 2020. For most plans that are out there that are benefit plans, they are calendar year plans. Which means their financial reporting period runs from January 1st to December 31st of every year. Which would mean that that this would go in effect for your plan year. That ends December 31, 2020. Which is of course, our current year that we're in that would be audited in the calendar year of 2021. So we're a little ways away from when this is going to be in effect for those plans. But as we've mentioned, you know, you don't want to get behind the game and have to find out late that your auditor is unable or unwilling to do your audit. But you do have a little bit of time here to worry about it. 

Jamie Nau: But like you said, it is effective right now. So if your year end is December 31, 2020, you're in the 2020 year. So can you go into those tests that are being required so I can make sure I'm not going to have findings on those this year because again, we are in that year right now.

Kim Moored: Right. Very good point. The things that you're doing in the 2020 year are going to be covered in the audits that that fall under this. Most of the areas that it talks about in the regulation are participant type transactions. So if you think about if you have a participant in your 401(k) plan, what kinds of activities could that participant go through during a plan. So they could become eligible to participate in the plan for the first time. They may be choosing to contribute, or may already be contributing to the plan. As the plan sponsor, you may make a contribution as a match, or a profit share, on behalf of the participant. A participant may take a distribution out of the plan, so they may withdraw money out of their account. They might take a loan against the funds in their account. They may be charged fees for the transactions that they occur during the year. All of those things are covered. Also, things that are regulatory requirements both by the IRS, and the Department of Labor are covered. So things like what a party in interest is, and there's a whole set of individuals and entities, that can be considered as parties and interests. I won't get in all those details but those individuals, or entities, may or may not have transactions between the plan and themselves, and they may, or may not be prohibited. So one of the things the auditor is going to have to do is look at all of those entities and individuals, and make sure that if there were prohibited transactions, that they were properly dealt with. So that's kind of a complicated area. That's something, again, if you're not sure about talk to your auditor about that. Get a little bit more information.

Jamie Nau: I think the key there is, as someone who has done audits a long time ago, it's just keeping documents and keeping organized, right? Because again, these are things that you probably have anyways. But the easier you can access them, and the better they're documented, the easier the audits going to go. So I think that's the biggest thing, is just making sure you're ready to pull these things when they're requested, because you want to have those documents pretty easy access to.

Kim Moore: So that's true. The other thing I would mention is that make sure that you're paying attention to any communication regarding the 401(k) plan. I mean, obviously anything you get from the IRS, or the Department of Labor, from a governmental agency regarding any type of benefit plan that you have, you always want to pay attention to those and make sure that you're doing anything that the communication requires you to do it. And if you're unsure, by all means, don't set it aside and say don't worry about it later, or this probably doesn't really matter. It always matters. So if you don't understand, there's always a phone number to call. Call and ask, because you don't want to get in trouble with a governmental agency about your plan. But the other thing is most plans today work with service providers. So the assets are held by some outside party. Then you're using another party usually to handle the day to day transactions. Most plans today don't do all that work themselves. They outsource that to a third party. So again, those third parties are going to communicate with you on a regular basis. They should be communicating to you about this change. If your plan requires an audit, if you have not heard from them, you should be in the near future. They're all still trying to figure out exactly what does this mean to them, because it may mean some changes on their end. But they should be communicating to you. So again, as you get those communications, whether it's in regard to this or anything else, pay attention to those communications. Make sure if you don't understand something, you're not sure, does this apply to me or not? Get with your third party assigned representative. If you don't have an assigned rep, call the 1-800 number. But make sure you keep on top of it because again, you don't want to get behind in trying to do something. Then when it comes to all of this being audited, then you run into problems because you didn't do something you were supposed to do, or you didn't keep documentation of something you were supposed to. Then you're going to run into problems when it gets to this coming into play. Which Jamie, that brings up another thing that is a requirement that isn't new, but it is spelled out very explicitly in the new standard, is that as I am conducting this audit in what will be 2021 for most plans, of the 2020 activity that occurred, if I as the auditor find things that either weren't completed, they weren't documented so I have no evidence that they occurred, or there was an error or something was done incorrectly, and completely not timely, things like that. So if something went wrong along the way I am required now as an auditor to give you documentation of that finding to the plan sponsor. There's something called an internal control memo, or interim control letter. It's separate from the report. It's a separate document, but that will go to the plan sponsor at the end of the audit. I am required to put those items in that memo. I'm required to give that to you and make sure that you understand those findings. So plan sponsors will be kind of on record now, with these written documents that they were told that whatever it was that they didn't do correctly, or they just didn't do at all. So there's no more oh, no one told me, I didn't know. You know, that's not going to be a valid excuse anymore. And the people that put together this new standard worked very closely with the Department of Labor on the standards. So the Department of Labor is very aware of this new requirement going in. So they're going to be, as they're doing their audits, or investigations, or just general inquiries, if they know that your plan has undergone an audit, that's one of the first things they're going to ask for, those memos. Then they're going to be looking to make sure that you as a plan sponsor were told that there was an error, or that you weren't doing something. So what did you do to fix it? And you want to be able to say yes, as soon as I found out I did A, B, C. You want to be able to answer that. You want to have documentation that you did it. So, again, your auditor should already have been doing this. They should already have been giving you a memo. We hear at Summit already do this. So if you have had an audit before, you know, and you didn't get the letter, ask your auditor about it. If you're a new plan, that's going to need an audit, another good question to ask as you're vetting out potential auditors is, do they do this already? What do those memos look like? When do you get them? How do they get delivered? Those kind of things are very good questions to be asking your auditor.

Jamie Nau: Great point. I think if you haven't received these letters in the past, obviously for this 2020 year, you are going to get those letters, and so it's important to get it and know what your findings were so you can have them fixed for this 2020 year because you are going to get that official letter now. And there's no excuses, like you said, most firms have been doing this and most firms do communicate it. But now that it's required, everybody's going to do it. Everybody knows that it's required. So you're going to be asked about it. So I think the biggest thing is know what those findings are, really focus on them, because those letters and those communications are to be a lot more efficient.

Kim Moore: That's correct. The last thing you want is the Department of Labor to pull them, and they see several years of the same findings that were never corrected. That would be not a good thing for you as a plan sponsor, and could result in pretty expensive fines and penalties if that were to occur. So definitely get on it right away. You know, make sure that doesn't happen because the last thing you want is a governmental agency coming after you.

Jamie Nau: You talked about there's quite a bit of work that sounds like it's coming out of this. I mean, again, I know a lot of it's been already done, but now that it's required work do you think fees will increase across the board? 

Kim Moore: I think it's a potential. I think everybody's looking at this. There’s been a lot of calls I'm on with some other firms that are talking about this. Everybody's kind of looking at it and saying, well, you know, for those of us that are already doing a lot of the work, I think there probably will be an increase in fees because there are going to be changes to just the letters themselves, the opinion letters all have to change. There's something called management representation letter, those have to change. Our engagement letters have to change. So one of the documents we're already doing, it's not that it's a whole new procedure that we have to do, but the procedure itself has to change. So I think there will be some increased fees associated with that. There are maybe a few additional types of work that we have to do that will cost some additional fees, but I think the big thing is for firms that weren't doing a lot of the work before, and they would be your low cost firms, they're going to have to increase their fees substantially because of this.

Jamie Nau: Yeah, that makes a lot of sense again. I mean, nothing is done for free, and when you're in a service based business, you have to evaluate exactly what's going on and what goes into the job. Like you said, this year alone, there's a lot of changes to wording. But then I think, you know, overall, there's a lot of changes to where we think about things and the way we approach the approach the audit.

Kim Moore: I think so, too. I think if you know, if you did the research recently, and you were trying to find a low cost provider, and you went with a low cost auditor out there that may have worked for a year or two. I think going forward, definitely their fees are going to have to increase substantially because they're going to have to do the work that the rest of us have already been doing just to be in compliance. So you may find that low cost may go away, and you may be back up to the higher fee. So, again, as we've said, good thing to talk about with your current auditor. You know, again, what are you planning to do if you looked at this? What are you thinking in terms of fees? Not necessarily that you can do anything about it as planned sponsor, but it does kind of give you a heads up as to your budget that you need going forward. You know, we always do budgets ahead of time, and maybe I need to increase that budget amount for the fee for the audit going forward. And again, that will give you a heads up to whether maybe they're not the right auditor, or maybe that auditor is going to drop doing these audits. So, again, good thing to be checking into ahead of time to find that out.

Jamie Nau: I want to take a quick second here to throw our e-mail address out there. So I know we mentioned this in every podcast, but you know, these topics, we want to make sure we're hitting on the right topics that our listeners care about. So if you have any topics, or if you want to be a guest, feel free to email us at: audit@summitcpa.net. So you know, looking forward to hearing from listeners about topics. So feel free to e-mail us. So Kim, any other areas that we need to hit on for this report and task?

Kim Moore: Yeah, the other thing I wanted to mention is that there are requirements in this new standard for documentation, certain specific documentation. A couple of examples are things like the plan documents. There's a portion of every plan document that needs to be signed by both the plan sponsor representative, usually some high level individual at your company. Then also your third party provider. That's going to be in charge of administering the plan for you. And usually what happens is they are electronic documents. They may, you know, once you get everything all settled and everybody's good with all the verbiage in the document, it either gets sent electronically and there's an electronic actual signature on the signature page, or they still do send them hard copy and there's a physical signature, and then it gets scanned and kept. Usually there's not multiple copies of those floating around, and when we as an auditor ask for a copy of those documents, which is very important part of our audit is getting the plan document copy that oversees how the plan needs to be administered. We usually get the copy. it's the final version of the plan document, but it's not a signed copy because usually that's in an archive somewhere. This is going to require us to actually get copies of the actual signed versions. I expect that's going to be problematic. That's going to take a lot of time and effort. The plan sponsor may not even have a copy of the signature. You know, they may have signed it and sent it back to the provider. So I think one thing to do ahead of time is start locating all of those things that that you had to sign when you first started the audit. Or maybe you've done a change to the audit. Start working on getting those signed copies. It'll make the audit a lot smoother once we get to the 2021 year when we're doing these audits.

Jamie Nau: That's a great tip. I think that will definitely be something that people should be thinking about now. I could totally see those being, you know, five years ago or however long ago some of them were signed.

Kim Moore: Yeah. Some of those were signed a long time ago. In my experience, the third party providers don't have very good record keeping on those kinds of things, which is surprising to me. But we do we do see that. The other thing that is kind of a change, a big change here is that ERISA allows for what in the current timeframe but what will change as part of this was a limited scope option to do audits. So if your custodian, the entity that actually holds the assets, usually an investment company or trust company or a bank, if they are audited by federal or state agencies on a regular basis and they're willing to provide an asset certification letter in their specifics around that, we've actually talked about that in another podcast. If they're willing to do all that, then you can have the audit conducted as a limited scope audit. It's less expensive and it takes less time usually around the investment portions of the audit. That is maintained in this new standard because that's part of ERISA. The audit standard couldn't change a ERISA. That's a congressional act. But they are changing the wording around the report. So there's different verbiage, which is more of a concern for us auditors who have to write up those letters. Well, one of the things that does require is that the plan's sponsor has to verify, independent of the auditor, that that what was called limited scope, the verbiage of it is to change, but that that is appropriate for your audit. That it does meet certain requirements, that it is an entity that can provide the certification. That they are audited on a regular basis, and that the letter itself, that asset certification letter, has the appropriate verbiage in it. So I expect that there's going to be a lot of back and forth. Most planned sponsors today don't do that. They don't understand that. They just know it's cheaper when I go to pay my audit, yes, I want that. But they don't really understand all the details of it. So, again, more to come on that. I think if you're already having an audit, something to ask your auditor about, the auditor can help you with that because your auditor has already been doing that for you, and so they can kind of help you with it and walk you through it. They may have a form that they need you to fill out that you've never done before. I'm expecting it's something you're going to have to sign and indicate that yes, I know I did all this this work. So anyways, more to come on that going forward. But just wanted to make everybody is aware that there is going to be more work on the plan sponsor side. That's one example. Probably the biggest thing that they'll have to do. But I expect there'll be a few more things that are going to get pushed back to the plan's sponsor from the auditor to do once this new regulation rolls out. So again, good topic to have with your auditor about what kinds of things do you see me having to do as a plan sponsor that's going to add to my time?

Jamie Nau: I think that's the main take away from this podcast. If you are, you're someone who's undergoing a 401(k) audit, you want to sound educated and you want to sound like you know what you're talking about, pop an email to your auditor. Call and say hey, tell me more about this SAS 136. They'll be pretty impressed. They will go, wow my client is on top of things.

Kim Moore: Yeah, exactly, and as the auditor I'm anticipating those questions. I'm very prepared and happy to answer them. Also, I am trying as we are beginning our audits for this year, to give our clients the information that this is coming. We belong to the Employee Benefit Plan Audit Quality Center, which is a part of the AICPA, a voluntary organization that gives us additional information specifically on benefit plan audits and auditing. And it gives us additional training materials, things like that. But there actually is a document that they've provided to us that we can share with our clients. It's the brief summary. I think it's about two pages long and talks about this upcoming change, you know, just gives you some real high level things to think about. So we'll be sharing that with our clients. You know, Jamie, through that email address, if any of you that are listening and are not clients of our and would like a copy of that document. I'd be happy to share it with you.

Jamie Nau: Yeah, that's that e-mail address was audit@summitcpa.net. So yeah, if you want a copy of that, feel free to email us and we'll definitely get back to you with that pretty quickly.

So yeah, we'd be happy to share it. We're close on time here. Any final thoughts for our listeners?

Kim Moore: I don't think so. It's more to come on this. I think just keep watching this space, and as we get more details, we'll do additional podcasts. We'll be doing blogs about it as well. So take a look at the Summit website, which is: summitcpa.net. Just take a look out there and we'll be having more information out there as it becomes available.

Jamie Nau: Yep, and just remember ask about SAS 136. That's the key. Thanks again for your time Kim. I appreciate all the time you put into this.


SAS 136 - Audit Report Update

Share this podcast episode on Twitter:
The 401(k) Audit CPA Success Show 🎙️ by @SummitCPAGroup:

Episode 6 - SAS 136 - Audit Report Update 👉 https://ctt.ec/ep80N+


Want to listen to more Summit CPA podcasts?

Click here


Leave a comment