Not-for-profit and public sector audits

A company exists to make a profit for its shareholders. A charity, a club or a government department exists to provide a service. That difference changes what the auditor looks for, where the risks are and what the report says. It does not change the fact that the auditor is still doing an audit.

This topic covers the objectives of not-for-profit organisations (NFPOs), the audit approach by stage, the special risks and controls, reporting, and the audit of public sector bodies. The syllabus asks you to explain how the audit of an NFPO differs from that of a profit-oriented entity, to assess the risks, to plan the audit and to suggest controls.

No written question in the two diets in the Pathfinder tests this topic on its own, but the syllabus names it, so expect it in a scenario.

The nature of a not-for-profit organisation

In any audit, the auditor must understand the entity and its environment, and a key part of that is the objective the entity is trying to achieve.

• In a commercial organisation, the objective is to make a profit for shareholders.
• In an NFPO, the objective is usually to provide a service to society as a whole or to a group in society. Examples are charities, clubs and societies and publicly owned organisations.
• The service must be provided within the resources the NFPO has. It seeks to achieve its objective within those limits.

Background: In Nigeria, many NFPOs are non-governmental organisations, religious bodies, associations and foundations. Many are registered as incorporated trustees or as companies limited by guarantee under Companies and Allied Matters Act 2020 (CAMA 2020): incorporated trustees under Part F (ss. 823 to 850) and companies limited by guarantee under s. 26, which bars paying income or property to members (s. 26(1)) and carrying on business to distribute profit to them (s. 26(3)).

Incorporated trustees file annual returns under s. 848. Whether a company limited by guarantee must be audited depends on whether it qualifies for the s. 402 exemption, which applies to small companies as defined in s. 394(3). The constitution or trust deed, the registration rules and any donor agreements set what the organisation may do with its money.

The audit approach

The auditor must recognise the special features of the NFPO. But the auditor is still carrying out an audit, and its overall structure is similar to the audit of a commercial organisation. The detail will probably differ. The table summarises the main points. They are general principles, to be modified to suit each NFPO.

Risk and cash

Controls over cash collection and payment may be a key area for an NFPO such as a charity. Volunteers may collect large amounts of cash from the public, often with few records. That is a control risk and also an inherent risk, because cash is easy to take.

Other factors to consider

• Cash may be significant in small NFPOs and controls are likely to be limited.
• Income is a risk area, particularly where money is donated or raised informally.
• Obtaining audit evidence may be difficult, which may limit the scope of the audit.
• Income may be unpredictable, and there may be no clear relationship between income and expenditure. That makes analytical review less useful.
• Restricted funds may exist, where money may be used only for specific purposes.
• There may be sensitivity to key statistics, such as the share of revenue spent on administration, particularly for a charity.

Controls an NFPO should have

The syllabus asks you to suggest control measures. The list above gives the main headings. Examples that apply them:

Reporting

If the law requires a report on the NFPO, the standard external auditor’s report covered in the later reporting topics can be used. If the audit is voluntary, the report must reflect the objective that was agreed. It is good practice to follow the structure laid down by ISA 700:

• title and addressee;
• the auditor’s opinion and the basis for opinion;
• going concern and key audit matters, if appropriate;
• responsibilities for the financial statements;
• the auditor’s responsibilities;
• other reporting responsibilities; and
• the name, signature and address of the auditor, and the date.

The syllabus also asks for the form and content of the audit report for an NFPO. The engagement letter should record what the audit covers, so that the report and the agreed objective match.

Public sector audit

The principles of an independent audit of a public sector entity under the ISAs are the same as for any other audit. The key difference is the nature of the entity, which affects audit risk and approach.

• Public sector audit is carried out by supreme audit institutions (SAIs). The OECD describes an SAI as a government entity whose external audit role is set by the constitution or by the supreme law-making body.
• SAIs follow the International Standards of Supreme Audit Institutions (ISSAIs), developed by INTOSAI, the International Organisation of Supreme Audit Institutions. The ISSAIs set out the prerequisites for the proper functioning and professional conduct of SAIs and the fundamental principles for auditing public entities.
• Many countries set up quasi-autonomous non-governmental organisations (QUANGOs) to audit public bodies. A QUANGO may or may not follow the ISAs. May or may not be independent as defined in the International Federation of Accountants (IFAC) or Institute of Chartered Accountants of Nigeria (ICAN) ethics code.

Public sector audit is covered in more detail in the Public Sector Accounting and Finance paper.

Background: In Nigeria, the Auditor-General for the Federation is the constitutional audit authority for federal public accounts, and each state has an Auditor-General for the state. Public audits often go beyond financial statements to compliance with law and value for money, as covered in the topics on assurance engagements.

The rules in more depth

Why the objective changes the audit

Profit is a measure that pulls the whole set of statements together. An NFPO has no such measure. Success is the service provided within resources. So the auditor looks at whether funds were received in full, spent on the stated purposes and recorded completely, rather than at profit.

Why income is a bigger risk than expenses

In a business, sales are recorded through invoices and systems. In an NFPO, much income arrives as cash or gifts with no document to prove it was due. The auditor cannot test the completeness of income by tracing from a sales record. Any income that is not recorded is simply missing. That is why completeness of income is a key risk.

Why a substantive approach is common

A small NFPO has few staff, volunteers who change often, and a board that meets rarely. Segregation of duties is hard and records are informal. The auditor cannot expect controls to work, so relies on direct evidence such as bank confirmations, vouching of payments, inspection of grant agreements and analytical review.

Why restricted funds matter

Money given for a specific purpose must be used for it. Spending it elsewhere may break the donor’s conditions and the law. The auditor checks that restricted funds are identified, kept in separate records and spent as the donor required.

Why public sector audit is still audit

The assurance given, the evidence needed and the need for independence are the same. What changes are the users (taxpayers and legislators), the risks (compliance with law and budgets) and the bodies that carry out the audit.

Worked example: planning the audit of a charity

1. Planning. Establish the objective of the audit (statutory or voluntary), the regulations that apply, the donors’ reporting requirements and the form of the opinion. Understand the activities and where the money comes from and goes.
2. Inherent risk. High. Large cash income, grant conditions and public sensitivity to administration costs.
3. Control risk. High. One bookkeeper records and banks the cash, volunteers collect without counts, and trustees meet rarely. The auditor should expect to place little reliance on controls.
4. Key risks. Completeness of cash donations; misuse of funds; breach of restricted fund conditions; understatement of administration costs to look better.
5. Approach. A substantive approach: observe a cash collection count, compare collections with past patterns, inspect grant agreements and test that restricted money was spent on its project, confirm bank balances, vouch expenditure, and test the split between administration and project costs.
6. Limits. Complete evidence on informal cash may not exist. If it cannot be obtained, this is a scope limitation that may affect the opinion.
7. Reporting. Follow the structure of ISA 700, and describe the agreed objective if the audit is voluntary.

Conclusion. Expect a substantive audit, with most effort on completeness of income, restricted funds and cash.

How to score full marks

• Start from the objective. Say that an NFPO provides a service within its resources and not a profit.
• Use the planning, risk, control, evidence, review and reporting headings. They are the syllabus’s structure.
• Rate each risk and say why. Link inherent risk to the activities and control risk to cash handling and small staff.
• Name the key audit areas: completeness of income, cash, misuse of funds and restricted funds.
• Say substantive, and give three procedures that fit the facts.
• For public sector, name SAIs, ISSAIs and INTOSAI, and say that the principles are the same as for any audit under the ISAs.
• Time. Spend time in proportion to marks.

Common mistakes in the exam

• Saying that an NFPO audit is not a real audit, or needs no opinion.
• Applying profit-based tests, such as margins, where income and expenditure have no link.
• Recommending a systems-based approach for a small NFPO with weak controls.
• Forgetting restricted funds.
• Ignoring the completeness of cash income.
• Not stating the objective and scope of the audit at planning.
• Confusing SAIs and ISSAIs, or INTOSAI and IFAC.

Quick revision

• NFPO objective: a service within available resources. Charities, clubs, societies, public bodies.
• Same structure as a commercial audit, different detail.
• Stages: planning; risk; internal control; audit evidence; review; reporting.
• Key areas: cash, income, misuse of funds, restricted funds, completeness.
• Small NFPO: substantive approach because of weak controls.
• Reporting: standard report if required by law; if voluntary, reflect the agreed objective and follow ISA 700.
• Public sector: SAIs, ISSAIs, INTOSAI, QUANGOs. The principles are the same as for any ISA audit.

Practice questions

These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.