Grantors send out requests for proposals (RFPs) asking CPA firms to confirm that monies are being spent properly. The RFPs ask that this work is conducted as a performance audit. But when pressed, the grantor just wants someone to check that the costs are accurately reported. In CPA land, that would be considered an attestation engagement, not a performance audit. The GAO's yellow book sees an auditors work in four categories:
1. a financial audit
2. a performance audit
3. an attestation engagement
4. a non-audit service
Audits (#1 and #2) are pretty involved engagements, requiring plenty of documentation and planning. Attestation engagements are less intense and hence less costly. And non-audit services don't follow audit standard at all - and thus could be very straightforward and easy to perform.
So if a grantor gets several responses to its RFP - one might color the engagement as the requestor designed it - as a performance audit. Another CPA firm will interpret the scope of work as an attestation engagement. And another CPA firm may interpret it as a consulting engagement. And if a non-CPA responds, they won't call it anything at all! They'll just agree to confirm the amounts.
The performance audit might cost $120K, the attestation engagement $70K, the consulting engagement $50K, and the non-CPA confirmation $20K. (Please realize I am estimating these amounts, pulling these out of the air... but I don't think I'm that far off..)
Who is right?
This all depends on what the client - the grantor - really wants. When confronted with these disparities in dollar amounts, they might rethink their request for a full blown audit. Unfortunately, they often don't even know what they are asking for. Performance audit sounds good, so they go with it. And this is too bad for everyone involved.. the bidders and the public and the clueless client who now has to go back to the drawing board. Reading chapter 1 of the 2007 Yellow Book would save everyone a bunch of trouble.