Clear communication is always helpful – in life and in business – to avoid unpleasant surprises or to confirm that you’re on the right track.
The Statement of Auditing Standards (SAS) 115, Communicating Internal Control Related Matters Identified in an Audit, reiterates the standards found in SAS 60 and SAS 112 for auditors to communicate information regarding internal control matters to managers and those in charge of corporate governance.
The communication requirement helps to maintain a dialogue with auditors. This interaction is an opportunity to obtain feedback, which may be used for improving internal control deficiencies, determining more appropriate measures for corrective action and establishing an improved system of monitoring internal controls.
Having effective internal controls is an important feature of error and fraud prevention. Your willingness to work with auditors and employees during these open discussion periods to address deficiencies should improve employee willingness to participate in auditors’ recommended changes.
This is the time to create a vibrant “tone at the top” philosophy within your company by working with the new pronouncement, not against it.
SAS 115 “is not applicable if the auditor is engaged to examine the design and operating effectiveness of an entity’s internal control over financial reporting that is integrated with an audit of the entity’s financial statements. …”
Simply, this communication directive applies only if auditors engaged to conduct a financial statement audit “become aware of deficiencies in internal controls” while performing various auditing procedures. If the auditor is engaged to perform procedures to identify deficiencies in internal controls, SAS 115 does not apply.
Deficiencies are viewed as either design issues or operation problems. If a control is necessary to meet the control objective and is missing, or if an existing control will not meet the control objective, the company has a design deficiency.
If a properly designed control does not operate as it was intended, or if the person performing the control is unauthorized or incompetent to perform the control effectively, the company has an operation deficiency.
Furthermore, a material weakness is a deficiency when “there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.”
A significant deficiency, although less severe than a material weakness, is important enough to merit your attention. Notice that the degree of severity will depend on whether an individual deficiency, or a combination of deficiencies, will have a significant impact on the financial statement amounts or the number of transactions.
For example, an officer may make one post-closing adjusting journal entry for millions of dollars without proper review, or an officer could create several special-purpose entities to remove debt from the company’s books. Dollar amounts and volume counts are important gauges for potential material deficiencies.
Auditors use risk factors to measure whether there is a reasonable probability that a deficiency will result in a misstatement. It will help you to know in advance whether these risk factors discussed in SAS 115 are present in your company:
1. The nature of the financial statement accounts, classes of transactions, disclosures and assertions
2. The susceptibility of the related asset or liability to loss or fraud
3. The subjectivity, complexity or extent of judgment required to determine the amount involved
4. The interaction or relationship of the control with other controls
5. The interaction among the deficiencies
6. The possible future consequences of the deficiency
Moreover, auditors will look for the following indicators to determine whether the material weaknesses in internal controls exist:
1. Identification of fraud by senior management
2. Restatement of financial statements because of material misstatements
3. Identification by the auditor of a material misstatement that would not have been detected by current internal controls
4. Ineffective oversight of financial reporting and internal control by people charged with governance
You should receive the auditor’s communication with content that varies depending on your company’s circumstances. Be prepared for language describing current or previous significant deficiencies and material weaknesses that were not corrected. The best way to avoid this portion of the notice is to engage in remedial procedures prior to the report.
Although this notice has a 60-day maximum time frame from the audit release, SAS 115 suggests certain significant findings may warrant earlier communication to management. You should take the initiative by asking for a status report during the audit engagement.
Engage in a proactive approach to the auditor’s report regarding your firm. Ask questions and request written communications during the audit.