1
AICPA Statement on Auditing Standards No. 112,
Communicating Internal Control Matters Identified in an Audit
NASACT Audio ConferenceOctober 19, 2006
2
Objectives
â—Ź Know the key concepts for this recently issued audit standard
â—Ź Identify the issues associated with implementing the standard (auditors)
â—Ź Identify the issues associated with those responsible for internal controls (preparers)
3
SAS No. 112, Communicating Internal
Control Matters Identified in an Audit
4
About SAS No. 112
â—Ź Issued May 2006
â—Ź Supersedes SAS No. 60
â—Ź Effective for audits of financial statements for periods ending on or after December 15, 2006
â—Ź Fairly short; brief Appendix
5
The Quick Snapshot
â—Ź Requires auditor to communicate, in writing, significant deficiencies and material weaknesses to management and those charged with governance
6
Definitions
â—Ź Control deficiency
♦Design or operation of a control that does not prevent or detect misstatements
7
Definitions● Significant deficiency—Control
deficiency(ies) that adversely affects the entity’s financial reporting process such that there is more than a remote likelihood that a misstatement in the financial statements that is more than inconsequential will not be prevented or detected
8
Definitions
● Material weakness—Significant deficiency(ies) that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected
9
Definitions
● Those charged with governance—The person(s) with responsibility for the entity’s strategic direction and accountability, including the financial reporting process
10
Evaluating Control Deficienciesâ—Ź The significance depends on the
potential for a misstatement, not an actual misstatement
â—Ź The absence of an identified misstatement does not provide evidence that a deficiency is not significant or material
11
â—Ź Nature of accounts, disclosures, and assertions
â—Ź Susceptibility to loss or fraud
â—Ź Subjectivity and complexity
â—Ź Cause and frequency of detected exceptions
Evaluating—Factors Affecting Likelihood
12
â—Ź Interaction or relationship of the control with other controls
â—Ź Interaction of deficiency with other deficiencies
â—Ź Possible future consequences of the deficiency
Evaluating—Factors Affecting Likelihood
13
Evaluating—Factors Affecting Magnitude● Financial statement amounts or
total transactions exposed
â—Ź Volume of activity in account balance or class of transactions affecting current or future periods
14
Evaluating—Other Considerations● Multiple control deficiencies that
affect the same financial statement account balance or disclosure
â—Ź Mitigating effects of effective compensating controls
â—Ź Results of tests of controls
15
Examples—Deficiencies That Are at Least Significant
Deficiencies in controls over:â—Ź Selection and application of GAAPâ—Ź Antifraud programsâ—Ź Nonroutine and nonsystematic
transactionsâ—Ź Period-end financial reporting process
16
Examples—Strong Indicators of Material Weaknesses
Presumptive requirement—significant deficiencies
â—Ź Ineffective oversight by those charged with governance
â—Ź Restatement of previously issued financial statements
â—Ź Material misstatement identified by the auditor
17
Examples—Strong Indicators of Material Weaknesses
Presumptive requirement—significant deficiencies
â—Ź Ineffective internal audit or risk assessment functions
â—Ź Ineffective regulatory compliance function, when applicable
â—Ź Any fraud by senior management
18
Examples—Strong Indicators of Material Weaknesses
Presumptive requirement—significant deficiencies
● Management’s failure to assess previously reported significant deficiencies
â—Ź Ineffective control environment
19
Communicating Deficiencies
â—Ź In writingâ—Ź To management/governanceâ—Ź All significant deficiencies and
material weaknessesâ—Ź Items reported in prior years, not yet
remediatedâ—Ź Within 60 days of report release date
20
Communicating Deficiencies
â—Ź Importance of early communications
● Management’s cost-benefit decisions does not relieve auditor responsibility
â—Ź Permits other matters to be communicated
21
Communicating Deficiencies
Content:
â—Ź Required elements
â—Ź Illustrative samples
â—Ź Management's written responses may be included
22
The Auditor’s Perspective
23
Impact on Auditors
â—Ź Timing
â—Ź Observations
â—Ź Concerns/Issues
24
Timing—Pre-SAS 112
Auditor’s report on financial statements
Management letters
Single Audit reports
Points for discussion
25
Timing—Using SAS 112
â—Ź All of these must now be communicated to management within 60 days after release date of our report on the CAFR/Basic Financial Statements
26
Timing—Using SAS 112
â—Ź Yellow Book report issued soon after CAFR, and not in our single audit report
â—Ź Management letter will also need to be issued within 60 days after our report on CAFR released
27
Our Experiment
â—Ź Take all the financial statement audits issued last year
● Summarize all findings into their four “buckets”
â—Ź Re-categorize the findings under the new criteria of SAS No. 112
28
Our Experiment
â—Ź Pre-SAS 112:Material weaknesses 3
Reportable conditions 11
Management letter 65
Points for discussion 340
Total 419
29
Our Experiment—Results
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Pre-SAS 112 Using SAS 112
Points for discussion Management letter items
Reportable conditions/significant deficiencies Material weaknesses
30
Our Experiment—Results
0 50 100 150 200 250 300 350 400
Pre-SAS112
Using SAS112
Material weaknesses 3 32
Reportable conditions/significantdeficiencies
11 156
Management letter items 65 78
Points for discussion 340 185
Pre-SAS 112 Using SAS 112
31
Observations
â—Ź Difference between government audits and other audits
♦Others—2 “vehicles” for reporting
♦Govt.—3 “vehicles” for reporting
32
Observations
â—Ź We noticed overlap with:
♦SAS No. 103
♦Risk Assessment Suite of Standards
♦Independence Standards
♦Government Auditing Standards
33
Observations
â—Ź Auditors need to make a clear change in their thought process
â—Ź Auditors may need to gather more information to make the SAS No. 112 determinations
34
Observations
â—Ź This will be a fresh look
35
Concerns/Issues
â—Ź Changing our process for Yellow Book reports and management letters
♦When to begin writing process
♦Sharing time for audit and writing
♦Getting auditee responses
36
â—Ź Developing clear understanding to assist in applying:
♦More than inconsequential
♦ “Reasonable” person
Concerns/Issues
37
â—Ź For Yellow Book audits, determining what goes in the management letter
Concerns/Issues
38
● Determining auditee’s inability to apply GAAP or prepare statements vs. choosing to have someone else do so (and other similar determinations)
Concerns/Issues
39
● Educating auditee (who’s job is it?)
♦Preparers
♦Management
♦Governing bodies
♦Employees responsible for performing control activities
Concerns/Issues
40
Management’s Perspective
41
Change in Perspective
â—Ź Former Points for Discussion now in Management Letter
â—Ź Former Reportable Conditions may now result in Qualified Opinion
â—Ź All without any change in operations
42
Change in Perspective
â—Ź Proposed Audit Adjustments
â—Ź Does this mean that Internal Controls were not effective in fairly presenting financial information?
â—Ź Sometimes methodology and approach differs
43
Application to Arizona
â—Ź Decentralized Environment
â—Ź 135 State agencies
â—Ź Some agencies have own system
â—Ź Some agencies have own financial statements
44
Application to Arizona
â—Ź Internal Controls combination of Statewide and Agency
â—Ź Reliance on Policies, Procedures, Communications
45
Application to Arizona
â—Ź Primary Concern: an Internal Control problem at a large agency or combination of agencies could now become a statewide Opinion Qualification
â—Ź Perception and Understanding of Importance of Internal Controls
46
Application to Arizona
â—Ź Planning and Preparation Essential
â—Ź Discuss with Auditors
â—Ź Coordinate with Agencies/CFOs
â—Ź Communication and Relationships Key
â—Ź Manage Expectations
47
Application to Arizona
Follow Common Project Cycle
â—Ź Plan
â—Ź Implement
â—Ź Evaluate
â—Ź Adjust as needed
48
Questions and Discussion