As expected, In July 2019, the AICPA Auditing Standards Board (ASB) issued AICPA Statement on Auditing Standards No. 136, Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA (“SAS No. 136″ or the “new EBP SAS”). This new standard prescribes certain new performance requirements for ERISA plan financial statement audits and changes the form and content of the related auditor’s report to improve audit quality and enhance the communicative value and transparency of the auditor’s report. It includes new requirements in all phases of an audit of ERISA plan financial statements including engagement acceptance, risk assessment and response, communication with those charged with governance, performance procedures, and reporting.
Good Bye Limited Scope Audit, Hello ERISA Section 103(a)(3)(C) Audit
Another significant change is that an audit performed pursuant to ERISA section 103(a)(3)(C) will no longer be referred to as a “limited scope audit” but rather going forward will be referred to as an “ERISA section 103(a)(3)(C) audit.” The new audit standard includes new performance and reporting requirements specific to ERISA section 103(a)(3)(C) audits.
Clarity on Management’s Responsibilities
As part of the auditor’s acceptance of the audit engagement the auditor will request plan management (sponsor/administrator) to acknowledge in the engagement letter management’s responsibilities for:
- maintaining a current plan instrument,
- administering the plan, and
- providing the auditor with a draft Form 5500 prior to the dating of the auditor’s report.
New Representations
In addition, the new standard requires that the auditor obtain certain written management representations at the conclusion of the engagement regarding those responsibilities. It also includes new acknowledgements related to management’s responsibilities with respect to the investment certification when management elects to have an ERISA Section 103(a)(3)(C) audit (previously called a “limited scope” audit as noted above).
Focus on Compliance
SAS No. 136 requires the auditor to perform certain procedures when planning and performing the audit that in the past were not expressly required. Most of the required procedures are already included as suggested audit procedures in the extant Audit and Accounting Guide, Employee Benefit Plans and our firm already performs these procedures. As a result, we do not expect the new requirements to result in significant changes to the procedures we perform. However, for some firm which do not currently perform the suggested procedures, substantial changes to audit planning and procedures may be necessary.
Effective Date
SAS No. 136 will be effective for audits of ERISA plan financial statements for periods ending on or after December 15, 2020. This means that 2020 year-end audits being performed in 2021 will be required to follow the performance and reporting requirements of this SAS, including using the new form of the auditor’s report. The EBP SAS prohibits early adoption.
Resources
The AICPA has published At a Glance, New Auditing Standard for Employee Benefit Plans which gives a summary of the changes coming for the benefit plan audits as well as the audit advisory, EBP SAS No. 136: Forming an Opinion and Reporting on Financial Statements of Employee Benefit Plans Subject to ERISA.
Details of the Key Changes of the New EBP SAS:
A new name and type of audit opinion – ERISA section 103(a)(3)(C) audits (previously referred to as “limited scope” audits)
An audit performed pursuant to ERISA section 103(a)(3)(C) will no longer be referred to as a “limited scope audit” but rather going forward referred to as an “ERISA section 103(a)(3)(C) audit.” The EBP SAS includes new performance and reporting requirements specific to ERISA section 103(a)(3)(C) audits.
The new EBP SAS notes that an ERISA section 103(a)(3)(C) audit is unique to EBPs and is not considered a scope limitation, therefore the auditor would no longer issue a modified opinion (typically a disclaimer of opinion) due to information that is certified by a qualified institution. Instead, the report provides a two-pronged opinion that is based on the audit and on the procedures performed relating to the certified investment information. It provides an opinion on whether the information not covered by the certification is presented fairly, and an opinion on whether the certified investment information in the financial statements agrees to or is derived from the certification.
Changes to form and content of auditor’s report
Report on audited financial statements
The EBP SAS significantly changes the form and content of the auditor’s report. The EBP SAS also includes reporting guidance when the auditor identifies a material inconsistency between the draft Form 5500 and the ERISA plan financial statements that requires revision of the audited ERISA plan financial statements or the Form 5500 and management refuses to make the revision.
For the first time, Generally Accepted Auditing Standards (GAAS) requires an ordering of certain report elements for all audit engagements, including ERISA audits. The “Opinion” section is required to be placed first, followed by the “Basis for Opinion” section. The “Basis for Opinion” section is new for all entities for which an opinion is issued, which includes a statement that the auditor is required to be independent. For ERISA section 103(a)(3)(C) reports the “Nature and Scope of the ERISA Section 103(a)(3)(C) Audit” section is required to be placed before the opinion and basis for opinion sections. The EBP SAS also requires the use of specific headings. The first section of the auditor’s report should include the auditor’s opinion and should have the heading “Opinion.” Directly following the “Opinion” section, the report should include a “Basis for Opinion” section. The content of the EBP SAS aligns with the requirements of SAS No. 134, Auditor Reporting and Amendments, Including Amendments Addressing Disclosures in the Audit of Financial Statements. It also contains incremental requirements specific to ERISA audits relating to management’s responsibilities for:
- maintaining a current plan instrument, including all plan amendments,
- administering the plan,
- determining that the plan’s transactions that are presented and disclosed in the financial statements are in conformity with the plan’s provisions, and
- maintaining sufficient records with respect to each of the participants, to determine the benefits due or which may become due to such participants
The EBP SAS includes illustrative auditor’s reports. In addition, the EBP SAS includes reporting guidance for the auditor’s report for audits:
- Conducted in accordance with both GAAS and another set of auditing standards.
- Where prior period financial statements were audited by a predecessor auditor.
- Where prior period financial statements were not audited.
For an ERISA Section 103(a)(3)(C) audit:
Different reporting requirements apply to ERISA Section 103(a)(3)(C) audits, as follows:
- The report provides a two-pronged opinion that is based on the audit and on the procedures performed relating to the certified investment information. It provides an opinion on whether the information not covered by the certification is presented fairly, and an opinion on whether the certified investment information in the financial statements agrees to or is derived from the certification. It also includes an additional sentence in the management’s responsibilities section related to the investment certification.
- The first section of the auditor’s report should include a description of the scope and nature of the ERISA Section 103(a)(3)(C) audit and should have the heading “Scope and Nature of the ERISA Section 103(a)(3)(C) Audit.”
- The
auditor’s responsibilities section should state that:
- state that the audit did not extend to the certified investment information, except for obtaining and reading the certification, comparing the certified investment information with the related information presented and disclosed in the financial statements, and reading the disclosures relating to the certified investment information to assess whether they are in accordance with the presentation and disclosure requirements of the applicable financial reporting framework.
- accordingly, the objective of the ERISA Section 103(a)(3)(C) audit is not to express an opinion about whether the financial statements as a whole are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.
Report on ERISA-required supplemental schedules
For an audit not subject to ERISA Section 103(a)(3)(C), the EBP SAS now requires the auditor, in situations when the auditor’s report on the audited financial statements contains an unmodified or a qualified opinion, to include a statement about whether, in the auditor’s opinion, the form and content of the information in the accompanying schedules are presented in conformity with the Department of Labor’s Rules and Regulations for Reporting and Disclosure under ERISA.
Other key provisions of the EBP SAS
The new standard includes new requirements in all phases of an audit of ERISA plan financial statements. Other key provisions included in the SAS include the following:
Engagement Acceptance
The EBP SAS includes new engagement acceptance requirements in addition to the preconditions for an audit in AU-C section 210, Terms of Engagement. It requires that the auditor obtain the agreement of management that it acknowledges and understands its responsibilities for the following (which can be done through the engagement letter):
- Maintaining a current plan instrument, including all plan amendments.
- Administering the plan and determining that the plan’s transactions that are presented and disclosed in the plan financial statements are in conformity with the plan’s provisions, including maintaining sufficient records with respect to each of the participants to determine the benefits due or which may become due to such participants.
- Providing to the auditor, prior to the dating of the auditor’s report, a draft of Form 5500 that is substantially complete.
- When
management elects to have an ERISA Section 103(a)(3)(C) audit, determining
whether o an ERISA Section 103(a)(3)(C) audit is permissible under the
circumstances,
- the investment information is prepared and certified by a qualified institution as described in 29 CFR 2520.103-8,
- the certification meets the requirements in 29 CFR 2520.103-5, and
- the certified investment information is appropriately measured, presented, and disclosed in accordance with the applicable financial reporting framework
Risk Assessment
The EBP SAS requires that the auditor:
- Obtain and read the most current plan instrument for the audit period, including effective amendments, as part of obtaining an understanding of the entity sufficient to perform risk assessment procedures.
- Consider whether to test specific plan provisions as part of risk assessment. Because of the nature of ERISA audits, it would be rare for the auditor, based upon the assessed risks of material misstatement at the relevant assertion level, not to test any relevant plan provisions. The EBP SAS includes an appendix A that provides some examples of plan provisions often included in a plan instrument by audit area.
Planning and Fieldwork
The EBP SAS requires that the auditor perform the procedures necessary to become satisfied that received and disbursed amounts (for example, employer or employee contributions and benefit payments) reported by the trustee or custodian were determined in accordance with the plan provisions. When designing and performing audit procedures, the auditor is required to consider:
- Relevant plan provisions that affect the risk of material misstatement at the relevant assertion level for classes of transactions, account balances, and disclosures.
- Whether management has performed the relevant IRC compliance tests, including but not limited to, discrimination testing, and has corrected or intends to correct failures, as applicable.
The auditor also is required to evaluate:
- Whether prohibited transactions identified by management or as part of the audit have been appropriately reported in the applicable ERISA-required supplemental schedules.
- Whether items identified that are not in accordance with the criteria specified (for example, not in accordance with the plan instrument), are reportable findings as defined in the EBP SAS.
When management elects to have an ERISA Section 103(a)(3)(C) audit, the auditor also is required to:
- Inquire of management about how management determined that the entity preparing and certifying the investment information is a qualified institution under DOL rules and regulations, and evaluate management’s assessment of whether the institution is qualified.
- Perform the
following procedures on the certified investment information:
- Obtain from management and read the certification as it relates to investment information prepared and certified by a qualified institution.
- Compare the certified investment information with the related information presented and disclosed in the ERISA plan financial statements and ERISA-required supplemental schedules.
- Read the disclosures relating to the certified investment information to assess whether they are in accordance with the presentation and disclosure requirements of the applicable financial reporting framework.
- Identify which investment information is certified, and perform audit procedures on the financial statement information, including the disclosures, not covered by the certification as well as noninvestment-related information based on the assessed risk of material misstatement. Plans may hold investments in which only a portion are covered by a certification by a qualified institution. In that case, the auditor should perform audit procedures on the investment information that has not been certified.
Documentation
If the auditor has determined that it is not necessary to test any relevant plan provisions as part of risk assessment, the auditor is required to document the considerations in reaching such conclusion.
Review of Draft Form 5500
The EBP SAS requires the auditor to make appropriate arrangements with management to obtain the draft Form 5500, and read the draft Form 5500 in order to identify material inconsistencies, if any, with the audited ERISA plan financial statements prior to dating the auditor’s report. If the auditor identifies a material inconsistency, he or she should determine whether the audited ERISA plan financial statements or the draft Form 5500 needs to be revised.
Communications with Management and Those Charged with Governance
The auditor is required to make certain EBP-specific communications with management and/or those charged with governance, as follows:
- Reportable findings (as defined in the EBP SAS) must be communicated in writing to management and those charged with governance in a timely manner in accordance with the requirements in other relevant AU-C sections.
- The auditor is required to discuss with management prohibited transactions with a party in interest of which the auditor has become aware that have not been properly reported in the applicable ERISA-required supplemental schedule.
- The auditor should communicate with those charged with governance the auditor’s responsibility with respect to Form 5500, procedures performed relating to Form 5500, and the results of those procedures.
The EBP SAS also addresses what the auditor should do when a material inconsistency between the draft Form 5500 and the ERISA plan financial statements is identified or when the auditor becomes aware of a material misstatement of fact.
For an ERISA Section 103(a)(3)(C) audit, if:
- The auditor has concerns about whether the entity preparing and certifying the investment information is a qualified institution, the auditor is required to discuss his or her concerns with management. If management does not provide sufficient information that supports its determination that the entity preparing and certifying the investment information is a qualified institution, then the auditor should discuss his or her concerns with those charged with governance and determine the implications for the audit.
- The auditor becomes aware that the certified investment information in the financial statements and related disclosures is incomplete, inaccurate, or otherwise unsatisfactory, the auditor should discuss the matter with management and perform additional procedures to determine the appropriate course of action.
The auditor should not issue a written communication stating that no reportable findings were identified during the audit.
Management Representations
The EBP SAS requires that the auditor obtain certain written management representations in addition to those required by AU-C section 580, as follows:
- That management has provided the auditor with the most current plan instrument for the audit period, including all plan amendments.
- Acknowledgement of its responsibility for administering the plan and determining that the plan’s transactions that are presented and disclosed in the ERISA plan financial statements are in conformity with the plan’s provisions, including maintaining sufficient records with respect to each of the participants to determine the benefits due or which may become due to such participants.
- When
management elects to have an ERISA Section 103(a)(3)(C) audit, acknowledgement
that management’s election of the ERISA Section 103(a)(3)(C) audit does not
affect its responsibility for the financial statements and for determining
whether:
- an ERISA Section 103(a)(3)(C) audit is permissible under the circumstances
- the investment information is prepared and certified by a qualified institution as described in 29 CFR 2520.103-8
- the certification meets the requirements in 29 CFR 2520.103-5, and
- the certified investment information is appropriately measured, presented, and disclosed in accordance with the applicable financial reporting framework
Reporting
In addition, the EBP SAS includes new reporting requirements as follows:
When identified prohibited transactions have not been appropriately reported in the applicable ERISA-required supplemental schedules, the auditor is required to:
- Modify the opinion on the supplemental schedule, when the effect of the transaction is material based on the financial statements as a whole.
- Include additional discussion in the other-matter paragraph in the auditor’s report on the supplemental schedules describing the prohibited transaction if the effect of the prohibited transaction is not material to the financial statements.
- If the prohibited party-in-interest transaction is material and is also considered a related party transaction, and that transaction is not properly disclosed in the notes to the plan financial statements, modify the auditor’s opinion on the financial statements due to a departure from the applicable financial reporting framework.
If you have any questions on how this new standard may affect your benefit plan audit, please do not hesitate to contact us.