Audit Considerations of the Paycheck Protection Program

The Coronavirus Aid, Relief, and Economic Securities (CARES) Act, signed into law on March 27, 2020, created the Paycheck Protection Program (PPP), responsible for over $600 billion in appropriated funds. Under the program, loans issued to qualified businesses used for payroll, rent and utilities, and interest on mortgages will be fully forgiven.

Now, management and accountants for these entities as well as their tax preparers, regulators, and auditors are tasked with ensuring the appropriate use and oversight of the funds.

AICPA Chief Auditor Bob Dohrer discusses audit considerations of the PPP with Senior Accounting Analyst Joseph Bailey.

Learn more about audit guidance

What should auditors consider when auditing the accounting treatment of PPP transactions? (1:00)

Evaluate the Amount of PPP Funding Received

The Small Business Administration (SBA) notified everyone of a $2 million threshold that may be subjected to further unknown regulatory oversight. Audit firms should look at the risk associated with an engagement where the client received more than $2 million. The government indicated there may be some form of audit with unknown details; auditors might want to consider the experience of the audit engagement team assigned or conduct second and concurring reviews for clients with PPP loans greater than $2 million.

Determine the Entity’s Fiscal Year-End

The periods over which PPP funds can be expended and are eligible for forgiveness changed from 8 to 24 weeks, which may span an entity’s year-end. Look at PPP transactions from receipt of the funding through notice of forgiveness to determine if the client’s fiscal year-end occurs during that time spectrum.

Understand the Entity’s Accounting Model

Debt Model

The least complex, most straightforward, and perhaps lowest risk accounting model is called the debt model. Under the debt model, upon receipt of PPP funds the entity records the funding as debt. After the entity applies for loan forgiveness, and receives approval notification from the SBA and lender, the entity records forgiveness of the debt as income. Any portion not forgiven remains on the balance sheet as debt.

Gain Contingency Model

Under a second, similar model – the gain contingency model – forgiveness is recorded when all contingencies have been met.

NFP Revenue Recognition and Government Grant Model

Two additional accounting models are the not-for-profit revenue recognition and government grant models (International Accounting Standard 20 – log in or request a demo for access). Under these models there is an opportunity to recognize revenue before the application for forgiveness is filed or granted. The early recognition of revenue is based on management’s judgment, estimates, expectations, and probabilities indicating that the conditions to be met for future PPP relief will indeed be met.

In General

Don’t panic. These transactions are not overly complex. Payroll, rent, utilities, and interest on mortgage are the types of transactions auditors see day in and day out. However, there is uniqueness in understanding the provisions of the CARES Act, and auditors need to be alert for things such as accuracy, completeness, fraud, and error.

Auditors are responsible for detecting material misstatement whether due to fraud or error, and have a responsibility to act appropriately if they become aware of noncompliance with the PPP. Auditors may find a client unintentionally violated aspects of the PPP because of the complexity of the legislation and lack of initial guidance on complying with the program requirements.

What internal controls are important to consider when auditing an entity’s accounting for PPP transactions? (10:30)

It is important that auditors focus on internal controls over the accuracy and completeness of PPP transactions. Ultimately, the accounting for those transactions, and their record-keeping, will become the very basis for the application for forgiveness. Controls such as segregation of duties and evidence of approval are essential.

Another aspect of internal controls, particularly when auditing those accounting methods where an entity is recognizing revenue before forgiveness is granted, is knowing there is a great deal of management judgment and estimation involved to determine the probability of loan forgiveness. Auditors should understand management’s process to assess those probabilities, the methodologies management used, and what management looked at in the way of estimates and projections. Further, internal controls over the accuracy and completeness of the underlying data used in those estimations and judgments are paramount.

Auditors should also consider internal controls over journal entries. In an environment with elevated fraud risk, management override of journal entries is a vehicle for perpetrating fraud, so be ultrasensitive to the internal controls around journal entries.

What do the entity and the auditor need to be aware of with respect to tax implications related to PPP transactions? (15:00)

The fundamental thing auditors need to be aware of is that the tax treatment being afforded to PPP transactions will likely create book and tax differences, resulting in deferred tax balances and disclosures in the financial statements.

Additionally, receipt of the funding is meant to be nontaxable, so expenses paid by PPP funding currently cannot be expensed for tax purposes. Further, the CARES Act opened opportunities for NOL carrybacks among other tax changes entities will want to consult with their tax experts on.

Are there principles embedded in the new AICPA standards on audit evidence or management estimates that an entity’s management and its auditor should consider with respect to the PPP or other forms of federal and state pandemic stimulus? (18:30)

There are principles in the new audit evidence (SAS 142 – log in or request a demo for access) and management estimates (SAS 143 – log in or request a demo for access) standards that are highly relevant in today’s environment.

For example, the audit evidence standard’s focus on the sufficiency and appropriateness of audit evidence. The framework auditors use to determine sufficiency and appropriateness of evidence consists of attributes such as accuracy, completeness, authenticity of information, and the risk of bias. Although maybe not directly related to PPP transactions, another example where the audit evidence standard can be useful is with remote audit procedures. The pandemic necessitated use of remote audit procedures and this will likely continue. The new evidence standard incorporates concepts around remote audit tools and techniques auditors may find relevant in today’s environment.

In relation to management estimates, particularly for the accounting models where revenue can be recognized before loan forgiveness, estimates and judgments are at their core. SAS 143 is helpful because it requires separate assessments of the inherent and control risk associated with an estimate and thereby results in more precise assessments of the risks of material misstatement.

While the new audit evidence and estimates standards are not required to be used or effective yet, they are available for early implementation.

Learn more about audit guidance