COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

7030 Drafting the Audit Report
Aug-2021

Overview

Performance audit reports are tabled in Parliament as part of the reports of the Auditor General or the Commissioner of the Environment and Sustainable Development. Special examination reports are transmitted to the board of directors of the Crown corporation and are reproduced in the Auditor General’s reports after they have been made public by the corporation.

Before examination work is complete—while audit teams are communicating findings orally to the entity or entities—work on drafting the audit report begins. The first draft remains internal to the OAG and is used to obtain input from the Auditor General, the assistant auditor general, the quality reviewer, internal specialists, and external advisers.

CSAE 3001 Requirements

34. In some cases, law or regulation of the relevant jurisdiction prescribe the layout or wording of the assurance report. In these circumstances, the practitioner shall evaluate:

(a) Whether intended users might misunderstand the assurance conclusion; and

(b) If so, whether additional explanation in the assurance report can mitigate possible misunderstanding.

[...]

56. The practitioner shall consider whether individual deviations identified during the engagement (other than those that are clearly trivial) have characteristics, for example a root cause or a problematic pattern, that indicate the aggregate effect of individual deviations is likely to be significant. (Ref: Para A120)

71. The assurance report shall be in writing and shall contain a clear expression of the practitioner’s conclusion about the underlying subject matter. (Ref: Para. A4, A159-A161)

72. The practitioner’s conclusion shall be clearly separated from information or explanations that are not intended to affect the practitioner’s conclusion, including any findings related to particular aspects of the engagements, recommendations or additional information included in the assurance report. The wording used shall make it clear that findings, recommendations or additional information is not intended to detract from the practitioner’s conclusion. (Ref: Para. A159-A161)

73. The assurance report shall include at a minimum the following basic elements:

(a) A title that clearly indicates the report is an independent assurance report. (Ref: Para. A162)

(b) An addressee. (Ref: Para. A163)

(c) A description of the objective of the engagement. (Ref: Para. 44, A2-A3)

(d) An identification or description of the level of assurance obtained by the practitioner, and the underlying subject matter. (Ref: Para A164)

(e) Identification or description of the applicable criteria. (Ref: Para. A144-A146, A165)

(f) Where appropriate, a description of any significant inherent limitations associated with the measurement or evaluation of the underlying subject matter against the applicable criteria. (Ref: Para. A166)

(g) A statement to identify the responsible party, and to describe their responsibilities and the practitioner’s responsibilities. (Ref: Para. A167)

(h) A statement that the engagement was performed in accordance with this CSAE or, where there is a subject-matter-specific CSAE, that CSAE. (Ref: Para. A168-A169)

(i) A statement that the firm of which the practitioner is a member applies CSQC 1, or other professional requirements, or requirements in law or regulation, that are at least as demanding as CSQC 1. If the practitioner is not a professional accountant, the statement shall identify the professional requirements, or requirements in law or regulation, applied that are at least as demanding as CSQC 1. (Ref: Para. A170)

(j) A statement that the practitioner complies with the independence and other ethical requirements of the relevant rules of professional conduct / code of ethics applicable to the practice of public accounting and related to assurance engagements, issued by various professional accounting bodies, or other professional requirements, or requirements imposed by law or regulation, that are at least as demanding. If the practitioner is not a professional accountant, the statement shall identify the professional requirements, or requirements imposed by law or regulation, applied that are at least as demanding. (Ref: Para. A171)

(k) An informative summary of the work performed as the basis for the practitioner’s conclusion.

[...]

(l) The practitioner’s conclusion on the objective of the engagement: (Ref: Para. A2-A4, A176-A181)

(i) When appropriate, the conclusion shall inform the intended users of the context in which the practitioner’s conclusion is to be read. (Ref: Para. A178)

(ii) In a reasonable assurance engagement, the conclusion shall be expressed in a positive form. (Ref: Para. A177)

(iii) In a limited assurance engagement, the conclusion shall be expressed in a form that conveys whether, based on the procedures performed and evidence obtained, a matter(s) has come to the practitioner’s attention to cause the practitioner to believe that there is a significant deviation in the underlying subject matter. (Ref: Para. A178)

(iv) The conclusion in (ii) or (iii) shall be phrased using appropriate words for the underlying subject matter and applicable criteria given the engagement circumstances.

(v) When the practitioner expresses a modified conclusion, the report shall contain:

  1. A section that provides a description of the matter(s) giving rise to the modification; and
  2. A section that contains the practitioner’s modified conclusion. (Ref: Para. A181)

(m) The practitioner’s signature. (Ref: Para. A182)

(n) The date of the assurance report. The assurance report shall be dated no earlier than the date on which the practitioner has obtained the evidence on which the practitioner’s conclusion is based including receipt of the written representations under paragraphs 61 and 62. (Ref: Para. A183)

(o) The location in the jurisdiction where the practitioner practices.

74. If the practitioner refers to the work of a practitioner’s expert in the assurance report, the wording of that report shall not imply that the practitioner’s responsibility for the conclusion expressed in that report is reduced because of the involvement of that expert. (Ref: Para. A184-A186)

75. If the practitioner is required by law or regulation to use a specific layout or wording of the assurance report, the assurance report shall refer to this or other CSAEs only if the assurance report includes, at a minimum, each of the elements identified in paragraph 73.

77. If the practitioner considers it necessary to communicate a matter other than those specifically related to the underlying the subject matter that, in the practitioner’s judgment, is relevant to intended users’ understanding of the engagement, the practitioner’s responsibilities or the assurance report, and this is not prohibited by law or regulation, the practitioner shall do so in a paragraph in the assurance report, with an appropriate heading, that clearly indicates the practitioner’s conclusion is not modified in respect of the matter.

CSAE 3001 Application Material

A2. The practitioner in a performance audit describes in the report the objective of the engagement and the underlying subject matter so that the reader can understand and properly interpret the results. The wording of the objective would be determined by the circumstances of the engagement. For example, the objective for a performance audit may be to conclude whether the entity being audited has adequately managed a program so that the entity’s key responsibilities under that program have been met. The practitioner’s conclusion relates to the objective and scope of the engagement and follows logically from the description of the criteria and findings. If the engagement has more than one objective, the assurance report provides a conclusion on each objective.

A4. Where the underlying subject matter is made up of a number of aspects, separate conclusions may be provided on each aspect. All such separate conclusions do not need to relate to the same level of assurance. Rather, each conclusion is expressed in the form that is appropriate to either a reasonable assurance engagement or a limited assurance engagement. References in this CSAE to the conclusion in the assurance report include each conclusion when separate conclusions are provided.

A120. “Clearly trivial” is not another expression for “not significant.” Matters that are clearly trivial will be of a wholly different (smaller) order of importance than significance determined in accordance with paragraph 49, and will be matters that are clearly inconsequential, whether taken individually or in aggregate and whether judged by any criteria of size, nature or circumstances. When there is any uncertainty about whether one or more items are clearly trivial, the matter is considered not to be clearly trivial.

A159. Oral and other forms of expressing conclusions can be misunderstood without the support of a written report. For this reason, the practitioner does not report orally or by use of symbols without also providing a written assurance report that is readily available whenever the oral report is provided or the symbol is used. For example, a symbol could be hyperlinked to a written assurance report on the Internet.

A160. This CSAE does not require a standardized format for reporting on all assurance engagements. Instead it identifies the basic elements the assurance report is to include. Assurance reports are tailored to the specific engagement circumstances. The practitioner may use headings, paragraph numbers, typographical devices (for example the bolding of text), and other mechanisms to enhance the clarity and readability of the assurance report.

A161. The practitioner may choose a “short form” or “long form” style of reporting to facilitate effective communication to the intended users. “Short-form” reports ordinarily include only the basic elements. “Long-form” reports include other information and explanations that are not intended to affect the practitioner’s conclusion. In addition to the basic elements, long-form reports may describe in detail the terms of the engagement, the applicable criteria being used, findings relating to particular aspects of the engagement, details of the qualifications and experience of the practitioner and others involved with the engagement and, in some cases, recommendations. The practitioner may find it helpful to consider the importance of providing such information to the information needs of the intended users. As required by paragraph 72, additional information is clearly separated from the practitioner’s conclusion and phrased in such a manner so as make it clear that it is not intended to detract from that conclusion.

A162. An appropriate title helps to identify the nature of the assurance report, and to distinguish it from reports issued by others, such as those who do not have to comply with the same ethical requirements as the practitioner.

A163. An addressee identifies the party or parties to whom the assurance report is directed. The assurance report is ordinarily addressed to the engaging party, but in some cases, there may be other intended users.

A164. Identification and description of the underlying subject matter may include, for example:

  • The point in time or period of time to which the measurement or evaluation of the underlying subject matter relates.
  • Where applicable, the name of the responsible party or component of the responsible party to which the underlying subject matter relates.
  • An explanation of those characteristics of the underlying subject matter of which the intended users should be aware, and how such characteristics may influence the precision of the measurement or evaluation of the underlying subject matter against the applicable criteria, or the persuasiveness of available evidence. For example:
    • The degree to which the underlying subject matter is qualitative versus quantitative, objective versus subjective, or historical versus prospective.
    • Changes in the underlying subject matter or other engagement circumstances that affect the comparability from one period to the next.

A165. The assurance report identifies the applicable criteria against which the underlying subject matter was measured or evaluated so the intended users can understand the basis for the practitioner’s conclusion. The assurance report may include the applicable criteria, or refer to them if they are otherwise available from a readily accessible source. It may be relevant in the circumstances, to disclose:

  • The source of the applicable criteria, and whether or not the applicable criteria are embodied in law or regulation, or issued by authorized or recognized bodies of experts that follow a transparent due process; that is, whether they are established criteria in the context of the underlying subject matter (and if they are not, a description of why they are considered suitable).
  • A statement that the responsible party agreed with the suitability of criteria or that the acknowledgement has not been obtained.
  • Measurement or evaluation methods used when the applicable criteria allow for choice between a number of methods.
  • Any significant interpretations made in applying the applicable criteria in the engagement circumstances.
  • Whether there have been any changes in the measurement or evaluation methods used.

A166. While in some cases, inherent limitations can be expected to be well-understood by the intended users of an assurance report, in other cases, it may be appropriate to make explicit reference to them in the assurance report. For example, in an assurance report related to the effectiveness of internal control, it may be appropriate to note that the historic evaluation of effectiveness is not relevant to future periods due to the risk that internal control may become inadequate because of changes in conditions, or that the degree of compliance with policies or procedures may deteriorate.

A167. Identifying relative responsibilities informs the intended users that the responsible party is responsible for the underlying subject matter, and that the practitioner’s role is to independently express a conclusion about the whether the underlying subject matter complies in all significant respects with the applicable criteria. The assurance report may include a statement that the responsible party acknowledged responsibility for the underlying subject matter or that the acknowledgement has not been obtained.

A169. A statement that contains imprecise qualifying or limiting language (for example, “the engagement was performed by reference to CSAE 3001”) may mislead users of assurance reports.

A170. The following is an illustration of a statement in the assurance report regarding applicable quality control requirements:

The firm applies Canadian Standard on Quality Control 1 and, accordingly, maintains a comprehensive system of quality control, including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

A171. The following is an illustration of a statement in the assurance report regarding compliance with ethical requirements:

We have complied with the independence and other ethical requirements of the [specify applicable rules of professional conduct / code of ethics], which are founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior.

A172. The summary of the work performed helps the intended users understand the practitioner’s conclusion. For many assurance engagements, infinite variations in procedures are possible in theory. In practice, however, these are difficult to communicate clearly and unambiguously. Other authoritative pronouncements issued by the Auditing and Assurance Standards Board may be useful to practitioners in preparing the summary.

A173. Where no specific CSAE provides guidance on procedures for a particular underlying subject matter, the summary might include a more detailed description of the work performed. It may be appropriate to include in the summary a statement that the work performed included evaluating the suitability of the applicable criteria.

A175. Factors to consider in determining the level of detail to be provided in the summary of the work performed may include:

  • Circumstances specific to the entity (for example, the differing nature of the entity’s activities compared to those typical in the sector).
  • Specific engagement circumstances affecting the nature and extent of the procedures performed.
  • The intended users’ expectations of the level of detail to be provided in the report, based on market practice, or applicable law or regulation.

A176. It is important that the summary be written in an objective way that allows intended users to understand the work done as the basis for the practitioner’s conclusion. In most cases, this will not involve detailing the entire work plan, but on the other hand, it is important for it not to be so summarized as to be ambiguous, nor written in a way that is overstated or embellished.

A177. An example of a conclusion expressed in a form appropriate for a reasonable assurance engagement is: “In our opinion, the entity has complied, in all significant respects, with XYZ law.”

A178. It may be appropriate to inform the intended users of the context in which the practitioner’s conclusion is to be read when the assurance report includes an explanation of particular characteristics of the underlying subject matter of which the intended users should be aware. The practitioner’s conclusion may, for example, include wording such as: “This conclusion has been formed on the basis of the matters outlined elsewhere in this independent assurance report.”

A180. Forms of expression which may be useful for underlying subject matters include, for example, “in compliance with” or “in accordance with.”

A181. Inclusion of a heading above paragraphs containing modified conclusions, and the matter(s) giving rise to the modification, aids the understandability of the practitioner’s report. Examples of appropriate heading include “Qualified Conclusion,” “Adverse Conclusion,” or “Disclaimer of Conclusion” and “Basis for Qualified Conclusion,” “Basis for Adverse Conclusion,” as appropriate.

A182. The practitioner’s signature is either in the name of the practitioner’s firm, the personal name of the individual practitioner or both, as appropriate for the particular jurisdiction. In addition to the practitioner’s signature, in certain jurisdictions, the practitioner may be required to make a declaration in the practitioner’s report about professional designations or recognition by the appropriate licensing authority in that jurisdiction.

A183. Including the assurance report date informs the intended users that the practitioner has considered the effect on the assurance report of events that occurred up to that date.

A184. In some cases, law or regulation may require a reference to the work of a practitioner’s expert in the assurance report, for example, for the purposes of transparency in the public sector. It may also be appropriate in other circumstances, for example, to explain the nature of a modification of the practitioner’s conclusion, or when the work of an expert is integral to findings included in a long form report.

A185. Nonetheless, the practitioner has sole responsibility for the conclusion expressed, and that responsibility is not reduced by the practitioner’s use of the work of a practitioner’s expert. It is important, therefore, that if the assurance report refers to a practitioner’s expert, that the wording of that report does not imply that the practitioner’s responsibility for the conclusion expressed is reduced because of the involvement of that expert.

A186. A generic reference in a long-form report to the engagement having been conducted by suitably qualified personnel including subject matter experts and assurance specialists is unlikely to be misunderstood as reduced responsibility. The potential for misunderstanding is higher, however, in the case of short-form reports, where minimum contextual information is able to be presented, or when the practitioner’s expert is referred to by name. Therefore, additional wording may be needed in such cases to prevent the assurance report implying that the practitioner’s responsibility for the conclusion expressed is reduced because of the involvement of the expert.

Financial Administration Act Requirements for Special Examinations

Section 139(1) An examiner shall, on completion of the special examination, submit a report on his findings to the board of directors of the corporation examined.

(2) The report of an examiner under subsection (1) shall include

(a) a statement whether in the examiner’s opinion, with respect to the criteria established pursuant to subsection 138(3), there is reasonable assurance that there are no significant deficiencies in the systems and practices examined; and
(b) a statement of the extent to which the examiner relied on internal audits.

OAG Policy

The engagement leader shall ensure that the audit team uses the official OAG template for drafting the audit report. If the official template is not used, the revised reporting format proposed by the audit team shall be approved by Audit Services. [Jul-2020]

In the audit report, the audit team shall identify the criteria used for the audit and disclose the sources of the criteria. [Nov-2016]

The audit report shall clearly identify the audited entity and describe entity management’s responsibilities with respect to the subject matter of the audit, along with the OAG’s responsibilities. [Nov-2016]

The team shall include in the audit report an informative summary of the work performed as the basis for the practitioner’s conclusion. This summary shall include information on the nature and extent of testing completed. [Nov-2016]

OAG Guidance

What the CSAE 3001 means for drafting the audit report

The CSAE 3001 lists several requirements for the assurance report. One of these requirements is to produce a report in writing, which includes a conclusion that shall be clearly separated from other information in the report. The following elements are also required to be included in the audit report:

Requirement Guidance

73(a) A title that clearly indicates the report is an independent assurance report

The cover page of every report includes the logo and the name of the Office of the Auditor General of Canada, which is recognized as an independent legislative audit office.

The cover page also includes the words “Independent auditor’s report” before the report title.

The cover page is part of the standard report template.

73(b) An addressee

The reports of the Auditor General and the Commissioner of the Environment and Sustainable Development are addressed to Parliament. Reports of audits in the three territories are addressed to the respective territorial legislative assemblies. The special examination reports are addressed to the board of directors of the Crown corporation.

This information is indicated on the cover page of the audit reports and is part of the standard report template.

73(c) A description of the objective of the engagement

The audit objective is determined in the planning phase (OAG Audit 4041 Audit objective and OAG Audit 4042 Audit scope and approach).

The team includes the audit objective in the report in the About the Audit section. A paraphrase of the objective is also included in the “Focus of the audit” section of the report.

73(d) An identification or description of the level of assurance obtained by the practitioner, and the underlying subject matter

To convey a reasonable level of assurance, the performance audit and special examination report templates state in several places that an audit is being performed.

The level of assurance is also part of the standard wording of the report template in the About the Audit section.

73(e) Identification or description of the applicable criteria

This information is part of the standard report template.

For performance audit reports, the criteria used are listed with their sources in a table in the About the Audit section.

For special examinations, the criteria used are listed in tables found throughout the audit report, and the sources of criteria are listed in the About the Audit section.

73(f) Where appropriate, a description of any significant inherent limitations associated with the measurement or evaluation of the underlying subject matter against the applicable criteria

If needed, the practitioner includes this information in a section judged appropriate in the audit report. Additions should be discussed with Audit Services.

73(g) A statement to identify the responsible party, and to describe its responsibilities and the practitioner’s responsibilities

The audit team describes the responsibilities of entity management in both the Background section and the About the Audit section of the audit report.

The OAG’s responsibilities are described in the About the Audit section of the report. This information is included as standard text in the report template.

73(h) A statement that the engagement was performed in accordance with this CSAE or, where there is a subject-matter-specific CSAE, that CSAE

Standard text is included in the report template in the About the Audit section.

73(i) A statement that the firm of which the practitioner is a member applies CSQC 1

Standard text is included in the report template in the About the Audit section.

73(j) A statement that the practitioner complies with independence and other ethical requirements

Standard text is included in the report template in the About the Audit section.

73(k) An informative summary of the work performed as the basis for the practitioner’s conclusion

The audit team includes this information in the “Scope and approach” section of the About the Audit section of the report.

This summary must include information on the nature and extent of testing completed.

It is recommended that this description also include information on sample selection, sample size, and population totals, when applicable.

73(l) The practitioner’s conclusion on the objective of the engagement

In the Conclusion section of the audit report, the audit team concludes against the audit objective and states any reservations (OAG Audit 7040 conclusion).

73(m) The practitioner’s signature

There is no explicit signature block in performance audit or special examination reports. There is only one Auditor General of Canada.

The required signature is provided by the OAG logo on the cover page of the report:

For traceability of the engagement leader, the list of team members is included in the “About the Audit” section.

73(n) The date of the assurance report

The date of the report is stated in a separate section of the report in the About the Audit section.

For additional guidance on dating the report, the audit team should refer to OAG Audit 8017 Report content approval and date of the report

73(o) The location in the jurisdiction where the practitioner practices

The audit team must determine the relevant location to indicate where the report is issued (usually during the planning phase while performing audit steps related to ethical and independence requirements).

The location in the jurisdiction where the practitioner practises is included in “Date of the report” in the About the Audit section of the audit report.

General factors to be considered and balanced in determining the practitioner’s location include

  • location of the head office of the audited entity;

  • location of the audit team members assigned to the engagement;

  • location of the closest OAG Office, including regional offices; and

  • location in which the majority of the audit work was performed (planning, examination, reporting).

For performance audits (including CESD reports and territorial performance audits), the location stated in the report is typically Ottawa, Canada. However, special attention should be paid to territorial performance audits not staffed from the Ottawa office or when a long continuous travel period occurred during the course of the audit.

For special examinations, these factors should be analyzed by the audit team in order to determine the proper location.

Purpose of the audit report

The OAG’s role, as external auditor of government, is to assist Parliament in its oversight of government spending and performance. Performance audit and special examination reports set out audit findings and recommendations for improvement in a way that is intended to be useful for the audited entities. The reports are also what the media and the public see of the work of the OAG. Thus, the reputation and credibility of the OAG depend to a great extent on the quality of the reports it issues. Audit reports must be written in a fair and factual manner so that they reflect the objectivity with which the audit was carried out.

In addition to meeting reporting requirements in CSAE 3001 audit reports must conform to the OAG’s standards for content, style, and accuracy. Audit reports use plain language, avoid jargon, define technical terms, organize ideas logically, and clearly distinguish descriptions of entity processes from audit findings. Substantiation of statements in the report is prepared by linking them to evidence and audit documentation. (OAG Audit 7060 Substantiation). Audit reports go through many versions to achieve these high standards. At the same time, audit teams must meet strict production deadlines.

The results of performance audits are reported to Parliament and the territorial legislative assemblies.

The main audience of a special examination report is Parliament, even though the report is addressed to the board of directors and made public by the Crown corporation. After the special examination reports have been made public by the Crown corporations, they are reproduced in the next set of reports of the Auditor General.

Structuring the audit report

The audit team structures the report based on what it considers to be of significance to Parliament. This may be different from the order of topics in the audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix).

Audit teams may choose to use a report mapping approach to structure the performance audit report. Report mapping is an optional step in report development that is done with the assistance of Editorial Services through a meeting (“report mapping session”) designed to help teams organize the information gathered during the examination phase and to identify and effectively convey the key findings of the audit as well as potential key messages.

In the second stage, the audit team moves from a summary of findings to drafting its report using the report template to ensure a consistent OAG format.

Audit teams consult the Editorial Services team and the Report Communications team for guidance and assistance with structuring the report. Teams must use the standard report template. If audit teams are making any changes to this template, Audit Services approval is needed.

The following are the elements of a report.

Report title. The report title is determined by the Communications team in consultation with the audit team. It is not subject to approval by the entity. The title reflects the main issue or activity covered by the audit, without any subtitles, and does not provide an indication of audit conclusions. Single entities are named in the title, but multiple entities are not.

Introduction. The introduction provides context to engage readers and help them understand the issues, without unnecessary detail. The introduction includes a description of the entity’s roles and responsibilities, as well as a statement of entity management’s responsibilities for the subject matter under audit, as set out in the audit plan summary (OAG Audit 4090 Audit plan summary for performance audits). The budgets of programs being audited, the overall entity budget, the historical context, the operational environment, the nature of business, and any exhibits such as relevant timelines, processes, or photographs may be included.

Findings. The audit teams should use the completed audit programs (OAG Audit 4070 Audit programs) as the starting point for drafting the findings. The team will have communicated findings orally to the entity as part of ongoing communications (OAG Audit 2030 Communication with the entity: initial and ongoing). Before issuing the principal’s (PX) draft report (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft), the team debriefs the entity to verify the facts to be reported in the report.

The discussion in the report on each finding addresses the following questions:

  • What was the criterion (required or desired state of affairs)?

  • Why is it important?

  • What was examined?

  • What we found (both positive and negative)? Quantitative measures should be used where possible.

  • What are the consequences (so whats)? Auditors should discuss the impact or potential impact of the difference between the situation found and the required or desired state set out in the criteria. The “so what” of an observed deficiency should explicitly state the impact of the criterion not having been met (e.g., “Without adequate cost information, National Defence cannot plan to have sufficient funds available for long-term operation and support of the helicopters”). This increases the attention that will be paid to the report and the chances that corrective action will be taken.

  • What are the underlying causal factors that explain observed deficiencies? By identifying the “why so,” the OAG informs Parliament by making more meaningful recommendations.

Special examinations

The purpose of this section is to inform the reader about the results of our special examination of selected key systems and practices. The special examination report must address key systems and practices and related criteria that were identified in the audit plan submitted to the audit committee at the beginning of the examination. Most special examination reports are organized using two general areas:

  • corporate management practices—includes areas common to all Crown corporations, such as governance, strategic planning, and risk management; and

  • management of operations—includes areas specific to the different types of operations for each Crown corporation.

In special examination reports, the findings section also integrates the use of tables for each level of enquiry. Tables present key findings against each of the criteria for each of the specific systems and practices examined. An assessment of whether the criterion for each of the systems and practices was met, based on the key findings included in the table, is also provided.

It is important to keep in mind that the OAG reports on the systems and practices examined that provide reasonable assurance that the Crown corporation is meeting its statutory control objectives. For example, in a special examination, teams do not examine whether the corporation is efficient; rather, the team reports on the systems and practices maintained by the corporation that provide reasonable assurance that the corporation is efficient. As an illustration, the objective of a special examination of a corporation’s infrastructure is not to state that “the bridges are safe.” What can be reported on is that “management receives reports related to the safety of the bridges. The reports include all relevant data and are provided in a timely manner.”

Considerable judgment is required to consider evidence from many sources and assess it against the criteria before drafting findings (OAG Audit 1042 Applying professional judgment). Furthermore, each section of the report must have a clear overall message. These sections refer to Level 2 (topical) headings.

Recommendations. Audits should include recommendations to point to the direction in which positive changes can be made for the most serious deficiencies reported. Recommendations should relate to strategic issues, address areas where there are significant risks to the entity, and prompt corrective action. Only serious weaknesses and significant deficiencies, and not necessarily each audit finding, should be addressed as recommendations. All recommendations should be action-oriented and guide the corrective action needed to fix the problems identified in the finding (OAG Audit 8020 Recommendations and entity responses).

To develop action-oriented and practical recommendations, the audit team should start drafting recommendations early and seek management’s views. Recommendations should be fully supported by and flow from the findings, and they should be aimed at correcting the underlying cause of the deficiency (OAG Audit 8020 Recommendations and entity responses).

Conclusion. In forming a conclusion, the auditor assesses the significance of the findings in relation to the audit objective. The conclusion should not be a summary of findings, but rather be a clear conclusion against the audit objective.

There are essentially four different types of conclusions that can be considered for an audit: clean conclusions (“yes”), qualified conclusions (“yes, but” or “no, but”), adverse conclusions (“no”), and denial conclusions (when the audit team is unable to conclude). Auditors need to clearly communicate the type of conclusion that is used. They also need to use judgment in forming a conclusion.

The conclusion is not a summary of the findings. For more details, refer to OAG Audit 7040 Audit conclusion.

For special examinations, the conclusion is worded to include an opinion statement, as required by the Financial Administration Act (FAA), on whether there are significant deficiencies in the systems and practices that we examined. The section also concludes explicitly against the audit objective, as set in the FAA, which is to determine whether the systems and practices we selected for examination at the Crown corporation are providing it with reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively as required by section 138 of the Financial Administration Act.

The wording of the conclusion (opinion) in a special examination is similar from one audit to another. The special examination report template provides the standard wording to be used.

If the work of an expert (internal or external) is mentioned in the audit report, the wording must not imply that the engagement leader’s responsibility for the conclusion is reduced because of the involvement of that expert (OAG Audit 2070 Use of experts).

Subsequent events. In the case of subsequent events, the engagement leader must ensure that a preliminary assessment of the impact of subsequent events on findings and conclusion is done, and where needed, that relevant information is included in the report (see OAG Audit 8030 Subsequent events).

About the Audit. This section describes clearly and concisely the design and execution of the audit in enough detail to give readers confidence that the audit findings are based on clear, well-defined questions, appropriate methodology, and adequate data sources. The components of About the Audit are as follows:

  • the statement of the professional standards followed (standard text in the report template);

  • a statement that, as part of our standard audit process, the audited entity

    • acknowledges responsibility for the underlying subject matter (as described in OAG Audit 4090 Audit plan summary for performance audits, or in OAG Audit 2030 Communication with the audit entity: initial and ongoing);

    • has reviewed and acknowledged the suitability of the criteria (as described in OAG Audit 4090 Audit plan summary for performance audits, or in OAG Audit 4100 Special examination plan);

    • provided written confirmation that it provided the audit team with all information of which the entity is aware that has been requested or that could significantly affect the findings or the conclusion of the assurance report (as described in OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft); and

    • acknowledges that the draft report is factually accurate (as described in OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft);

  • the audit objective;

  • a brief, yet informative, description of the scope and approach;

  • the audit criteria and their sources for performance audits or for special examinations, the sources of criteria for special examinations;

  • the period covered by the audit—the period to which the audit conclusion applies;

  • the date of the report (see OAG Audit 8017 Report content approval and date of the report); and

  • the audit team.

If one or more of the entities’ written confirmations (that is, of management’s responsibility for the subject matter, of suitability of criteria, that all information requested has been received; or of validity of facts and final responses to recommendations) are not received, the audit team must consider the impact, if any, on the audit work, audit report, and conclusion. Teams must disclose the nature of any unresolved difference in the audit report. Some options to consider are a description of the disagreement in the body of the report, or a modification of the standard wording in the About the Audit section to state that the requested acknowledgement has not been obtained and to explain why.

Exhibits. The preparation of exhibits and other graphic elements normally begins during the initial drafting of the report and continues through to the final printing. There may be several iterations of an exhibit before it is finalized. The successful use of graphics is improved by integrating them into early drafts of the report. Exhibits from government and other sources may be subject to copyright and audit team should contact Legal Services for assistance in obtaining permission to reproduce the original.

Follow-up performance audit work

The Auditor General regularly tables reports which include elements of follow-up audit work. These reports report on progress made by the government in responding to recommendations contained in previous performance audit reports and in addressing the underlying findings, but they may include new audit work as well. When concluding on the audit objective(s), the follow-up elements should be distinguished from the new audit elements. The report structure for follow-up audit work is similar to that for other performance audit reports, with some exceptions:

  • finding—at the end of each finding, there is a rating of satisfactory or unsatisfactory for the way the entity has either implemented the original recommendation or resolved the issues related to the original recommendation or significant findings;

  • conclusion—in addition to concluding against the audit objective based on the evidence collected during the examination phase, for follow-up work, the conclusion indicates whether the entity has fully implemented the previous recommendations and, if not, whether satisfactory progress has been made toward implementing them.

Role of the Office’s Editorial Services team

Producing audit reports that meet the OAG’s quality standards is a team effort, involving not only the responsible audit team, but also other groups within the Office. The Editorial Services team holds primary responsibility for ensuring that OAG audit reports are written in language that is easy to read and understand. Since the Official Languages Act requires reports from the Auditor General to be tabled in both official languages, the Editorial Services team is responsible for providing accurate translations.

In addition, the Editorial Services team contributes to ensuring that messages are clear, unambiguous, and easy to interpret.

Next steps

When the internal draft is complete, the audit team seeks input from the internal specialists and external advisers (OAG Audit 2050 Advisory committee meetings). The team should plan enough time to allow for these levels of review. Following these reviews and the required revisions, the team sends the principal’s (PX) draft to the entity (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft).

Related Sections

OAG Audit 1042 Applying professional judgment
OAG Audit 2030 Communication with the entity: initial and ongoing
OAG Audit 2040 Discussions with the Auditor General
OAG Audit 2050 Advisory committee meetings
OAG Audit 2070 Use of experts
OAG Audit 4041 Audit objective
OAG Audit 4042 Audit scope and approach
OAG Audit 4044 Developing the audit strategy: audit logic matrix
OAG Audit 4070 Audit programs
OAG Audit 4090 Audit plan summary for performance audits
OAG Audit 4100 Special examination plan
OAG Audit 7060 Substantiation 
OAG Audit 8017 Report content approval and date of the report
OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft
OAG Audit 8020 Recommendations and entity responses
OAG Audit 8030 Subsequent events