External Quality Assurance Review, Division of Internal Audit Services

The scope of such review will be as prescribed by the Comptroller General of the United States in the Government Accountability Office publication titled, Government Auditing Standards (2024 Revision). Some of the relevant provisions of Chapter Five of the Government Auditing Standards that the selected firm is required to comply with when performing Services are summarized below: Each audit organization conducting engagements in accordance with GAGAS must obtain an external peer review at least once every three years conducted by reviewers independent of the audit organization being reviewed. The peer review should be sufficient in scope to provide a reasonable basis for determining whether, for the period under review, (1) the reviewed audit organization’s system of quality control was suitably designed and (2) the organization is complying with its quality control system so that it has reasonable assurance that it is performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects. Assessment of Peer Review Risk The peer review team should perform an assessment of peer review risk to help determine the number and types of engagements to select for review. Based on the risk assessment, the peer review team should select engagements that provide a reasonable cross section of all types of work subject to the reviewed audit organization’s quality control system, including one or more engagements conducted in accordance with GAGAS. Peer Review Report Ratings The peer review team should use professional judgment in deciding on the type of peer review rating to issue; the ratings are as follows: a. Peer review rating of pass: A conclusion that the audit organization’s system of quality control has been suitably designed and complied with to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects. b. Peer review rating of pass with deficiencies: A conclusion that the audit organization’s system of quality control has been suitably designed and complied with to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects with the exception of a certain deficiency or deficiencies described in the report. c. Peer review rating of fail: A conclusion, based on the significant deficiencies described in the report, that the audit organization’s system of quality control is not suitably designed to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects, or that the audit organization has not complied with its system of quality control to provide the audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements in all material respects. The peer review team should determine the type of peer review rating to issue based on the observed matters’ importance to the audit organization’s system of quality control as a whole and the nature, causes, patterns, and pervasiveness of those matters. The matters should be assessed both alone and in aggregate. The peer review team should aggregate and systematically evaluate any observed matters (circumstances that warrant further consideration by the peer review team) and document its evaluation. The peer review team should perform its evaluation and issue report ratings as follows: a. If the peer review team’s evaluation of observed matters does not identify any findings (more than a remote possibility that the reviewed audit organization would not perform, report, or both in conformity with professional standards and applicable legal and regulatory requirements), or identifies findings that are not considered to be deficiencies, the peer review team issues a pass rating. b. If the peer review team’s evaluation of findings identified deficiencies but did not identify any significant deficiencies, the peer review team issues a pass with deficiencies rating and communicates the deficiencies in its report. c. If the peer review team’s evaluation of deficiencies identified significant deficiencies, the peer review team issues a fail rating and communicates the deficiencies and significant deficiencies in its report. Availability of the Peer Review Report An internal audit organization that reports internally to management and those charged with governance should provide a copy of its peer review report to those charged with governance. Because information in peer review reports may be relevant to decisions on procuring audit services, an audit organization seeking to enter into a contract to conduct an engagement in accordance with GAGAS should provide the following to the party contracting for such services when requested: a. the audit organization’s most recent peer review report, and b. any subsequent peer review reports received during the period of the contract. Auditors who are using another audit organization’s work should request a copy of that organization’s most recent peer review report, and the organization should provide this document when it is requested. Peer Review Scope The peer review team should include the following elements in the scope of the peer review: a. review of the audit organization’s design of, and compliance with, quality control and related policies and procedures; b. consideration of the adequacy and results of the audit organization’s internal monitoring procedures; c. review of selected audit reports and related documentation and, if applicable, documentation related to selected terminated engagements prepared in accordance with paragraph 5.55c, if any terminated engagements are selected from the universe of engagements used for the peer review sample; d. review of prior peer review reports, if applicable; e. review of other documents necessary for assessing compliance with standards, for example, independence documentation, CPE records, and relevant human resource management files; and, f. interviews with selected members of the audit organization’s personnel in various roles to assess their understanding of and compliance with relevant quality control policies and procedures. Written Agreement for Peer Review The peer review team and the reviewed audit organization should incorporate their basic agreement on the peer review into a written agreement. The written agreement should be drafted by the peer review team, reviewed by the reviewed audit organization to ensure that it accurately describes the agreement between the parties, and signed by the authorized representatives of both the peer review team and the reviewed audit organization prior to the initiation of work under the agreement. The written agreement should state that the peer review will be conducted in accordance with GAGAS peer review requirements. Peer Review team The peer review team should meet the following criteria: a. The review team collectively has adequate professional competence and knowledge of GAGAS and government auditing; b. The organization conducting the peer review and individual review team members are independent (as defined in GAGAS) of the audit organization being reviewed, its personnel, and the engagements selected for the peer review; c. The review team collectively has sufficient knowledge to conduct a peer review. Report Content The peer review team should prepare one or more written reports communicating the results of the peer review, which collectively include the following elements: a. a description of the scope of the peer review, including any limitations; b. a rating concluding whether the system of quality control of the reviewed audit organization was adequately designed and complied with during the period reviewed and would provide the audit organization with reasonable assurance that it conformed to professional standards and applicable legal and regulatory requirements; c. specification of the professional standards and applicable legal and regulatory requirements to which the reviewed audit organization is being held; d. reference to a separate written communication, if issued under the peer review program; e. a statement that the peer review was conducted in accordance with GAGAS peer review requirements; and f. a detailed description of the findings, conclusions, and recommendations related to any deficiencies or significant deficiencies identified in the review. Audit Organization’s Response to the Peer Review Report If the reviewed audit organization receives a report with a peer review rating of pass with deficiencies or fail, the reviewed audit organization should respond in writing to the deficiencies or significant deficiencies and related recommendations identified in the report. With respect to each deficiency or significant deficiency in the report, the reviewed audit organization should describe in its letter of response the corrective actions already taken, target dates for planned corrective actions, or both. The following information pertains to the UCS Division of Internal Audit Services internal audit staff: Number of professional staff: 23 Albany 5 Buffalo 5 New York City 5 Rochester 3 Syracuse 5 Principal Office: Syracuse, New York Location of workpapers: Electronic The proposed quote must at least include the following: A) Number of firm staff to be assigned to perform the Services. B) Senior staff member(s) name(s) and qualifications. C) Junior staff member(s) name(s) and qualifications. D) Applicable billing rates per hour for all assigned staff. E) Proposed approach to performing the Services. F) Estimated hours to perform the Services. G) Total cost to perform the Services, excluding Travel Expenses as defined in G below. H) Travel Expenses: Only those necessary and documented per diem expenses shall be reimbursed and at such rates not to exceed those currently paid to non-judicial employees of the UCS. See UCS Per Diem rates: https://www.inside-ucs.org/oca/financial/pdfs/UCS-PerDiemRates.pdf. Travel expenses must be approved in advance by the Director of Internal Audit Services.