How restricted-use reports and compliance reporting work in specialized engagements.
In governmental audits and other specialized engagements, auditors often face unique requirements regarding how and to whom their reports are distributed. Restricted use reports address specific bodies—such as legislative committees or regulatory agencies—and include cautions that the reports are not intended to be used by broader or unintended audiences. Additionally, auditors conducting governmental or compliance-focused engagements must remain vigilant about identifying, reporting, and addressing instances of material noncompliance or illegal acts.
This section will discuss (1) the nature and purpose of restricted use disclaimers, (2) the importance of reporting material noncompliance or suspected fraud, and (3) other communication requirements when dealing with potential illegal acts or confidentiality constraints. The goal is to help auditors navigating governmental and specialized engagements appreciate and fulfill their unique responsibilities under the relevant standards and regulations.
Auditors in governmental and compliance engagements frequently issue reports with a “restricted use” disclaimer. These disclaimers explicitly limit the distribution of the auditor’s report to specific agencies, regulatory bodies, or legislative committees and clarify that the report is not suitable for other individuals or broader audiences.
Restricted use statements commonly appear in the following scenarios:
• When an auditor is engaged by a governmental entity to report findings solely to a funding agency, inspector general’s office, or legislative committee.
• When the scope of the auditor’s procedures is defined by a contract or statute that limits distribution of the report.
• When certain proprietary or confidential information must remain within specific government channels.
Under the AICPA’s AU-C Section 905, “Alert That Restricts the Use of the Auditor’s Written Communication,” auditors must:
• Clearly identify the intended users (e.g., specific regulatory agencies, oversight committees).
• Explain that the report is not intended to be used by anyone other than the specified parties.
• Provide a concise basis for the restriction.
A properly worded restricted use alert helps avoid misunderstandings by clarifying that the report’s content may not be suitable for other contexts or decision-making needs.
In governmental audits (including those performed under Government Auditing Standards or Single Audit requirements), the auditor must assess and communicate instances of material noncompliance or suspected fraud:
• Definition of Material Noncompliance: Noncompliance that could significantly affect the financial statements or the entity’s operations to the extent that it potentially alters user conclusions.
• Obligation to Inform: If the auditor identifies noncompliance, they should evaluate the severity—both quantitative (e.g., monetary amounts involved) and qualitative (the nature of the noncompliance). If deemed material, the auditor typically includes the finding in their report and considers whether an opinion modification or emphasis-of-matter paragraph is warranted.
• Fraud vs. Noncompliance: Although fraud involves intentional misrepresentation, noncompliance may also include oversights, regulatory breaches, or the misuse of restricted funds. Either can be grounds for reporting obligations under governmental audits.
• Implications for the Auditor’s Opinion:
Beyond the direct reporting of material noncompliance, some governmental audits may also demand more explicit communication protocols for suspected illegal acts:
• Immediate Notification: Certain statutes or regulations specify that suspected illegal acts must be reported immediately to an oversight agency, such as an inspector general’s office. For instance, the U.S. Department of Defense, Department of Health and Human Services (HHS), and other federal departments maintain inspector general offices with stringent reporting mandates.
• Confidentiality Considerations: In deciding how to report potentially illegal acts, the auditor must balance professional confidentiality with legal and ethical obligations. Some engagements may involve explicit waivers of confidentiality or require immediate disclosure to designated authorities, possibly superseding client-auditor privilege.
• Whistleblower Protections: Government audits often occur within a framework of whistleblower statutes that protect individuals who report wrongdoing. Auditors should be aware of these legal shields to guide clients or staff who may have knowledge of fraud or noncompliance.
• Standards Reference:
Below is a simple diagram illustrating the decision points an auditor may encounter when issuing a restricted use report and identifying material noncompliance in a governmental engagement.
flowchart TB
A["Conduct Government/Compliance Audit"] --> B["Identify Noncompliance or Exceptions"]
B --> C{"Is Noncompliance Material?"}
C -- "Yes" --> D["Modify Opinion or Add Emphasis-of-Matter"]
C -- "No" --> E["Include Non-Material Finding in Report if Relevant"]
D --> F["Consider Restricted Use Alert if Required"]
E --> F["Consider Restricted Use Alert if Required"]
F["Issue Final Audit Report with Restricted Use Disclaimer"]
In this flow:
• If noncompliance or an exception is found, the auditor evaluates whether it is material.
• If material, the auditor may modify the opinion or add an emphasis-of-matter paragraph.
• Regardless of materiality, if the engagement scope or legislation requires restricted distribution, the report includes a restricted use disclaimer.
• Restricted Use Reports: Communications intended only for specified parties (e.g., legislative committees, regulatory agencies) because of the scope and nature of the engagement.
• Material Noncompliance: Instances of noncompliance that significantly affect the financial statements or operations of an entity and could alter the user’s decisions.
• Reporting Illegal Acts: Additional reporting obligations common in governmental audits; suspected illegal acts often trigger immediate notifications to inspector general offices or other oversight bodies.
• Whistleblower: An individual who comes forward with information about wrongdoing, protected under specific legal frameworks intended to shield them from retaliation.
Suppose an auditor is engaged by a state government department to review compliance with specific grant restrictions. During the engagement, the auditor discovers that a significant portion of the awarded funds was used for expenses unrelated to the grant’s purpose. Upon investigation, the auditor concludes this misuse is material. The proper course of action would include:
This scenario highlights why auditors must be mindful of both the quantitative and qualitative significance of misused funds and how restricted use disclaimers help maintain clarity for readers not intended to rely on the specialized compliance report.
Disclaimer: This course is not endorsed by or affiliated with the AICPA, NASBA, or any official CPA Examination authority. All content is created solely for educational and preparatory purposes.