Communicating Internal Control Matters - SAS NO. 115
In a move designed to improve communication regarding internal control matters, Statement on Auditing Standards (SAS) No. 112 was replaced by SAS No. 115, which is effective for audits of financial statements for periods ending on or after December 15, 2009. What do you need to know about the changes? First, let’s go over the basics.
What is internal control and what are control deficiencies?
Internal control is designed to provide reasonable assurance that organizational objectives regarding the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations are met.
A control deficiency exists when the design or operation of a control will not allow management or employees to prevent, or to detect and correct financial misstatements. In an audit, it is not required for the CPA to perform procedures to identify deficiencies in internal control, and there is no requirement that the auditors express an opinion on the effectiveness of internal control. However, the CPA might become aware of control deficiencies while conducting the audit.
How has SAS 115 changed how control deficiencies are defined?
SAS No. 115 has altered the definitions of significant deficiency and material weakness in order to align them with the Public Companies Accounting Oversight Board (PCAOB). This change in wording has also resulted in changes to the reports applicable to compliance under the Yellow Book and Circular A-133 reporting.
A material weakness occurs when there is a reasonable possibility that a material misstatement in the financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
How will auditors now evaluate potential control deficiencies?
When practitioners become aware of control deficiencies while performing financial statement audits, there is a need to evaluate the severity of each deficiency in order to determine whether the deficiency rises to the level of a significant deficiency or even a material weakness.
SAS 115 does not include the "listing" of deficiencies that normally would rise to the level of at least a significant deficiency, an aspect of SAS 112 which caused auditors to function in more of a "rules" based environment as opposed to a principles-based environment. With this new guidance, practitioners are more able to utilize their professional judgment in deciding whether deficiencies rise to the level that need to be communicated to management and to those charged with governance.
SAS 115 does list deficiency indicators which may demonstrate material weaknesses including:
- Identification of fraud on the part of senior management.
- Restatement of previously issued financial statements to reflect a correction of a material misstatement in those statements that was a result of either error or fraud.
- Identification of a material misstatement in the financial statements in circumstances where the indication is that the misstatement would not have been detected by internal control.
- Ineffective oversight of the financial reporting and internal control processes by those charged by governance.
If control deficiencies are found, how will they be communicated?
In circumstances where control deficiencies have been identified in performing the audit and it is concluded that they either fall within the confines of significant deficiencies or material weaknesses, those deficiencies need to be communicated, in writing, to both management and those charged with governance as a part of each audit. Where deficiencies identified by prior audits have not been remediated, those situations must also be noted.
In many circumstances, the existence of significant deficiencies and/or material weaknesses may already be known to management and those charged with governance, but a decision has been made to accept the risk associated with those deficiencies for cost or other considerations. Those decisions are the responsibility of management; however, the practitioner still has a communication responsibility.
The replacement of SAS 112 with SAS 115 should result in better communications to auditees by allowing the CPA to exercise more judgment as to whether control deficiencies identified during the audit rise to the level of significant deficiencies and/or material weaknesses. By having these communications, auditors will be better able to assist the nonprofit organizations they work with in promoting consistency, accuracy, and good governance practices.