1 AICPA Statement on Auditing Standards No. 112, Communicating Internal Control Matters Identified in an Audit NASACT Audio Conference October 19, 2006.

1

AICPA Statement on Auditing Standards No. 112,

Communicating Internal Control Matters Identified in an Audit

NASACT Audio ConferenceOctober 19, 2006

2

Objectives

● Know the key concepts for this recently issued audit standard

● Identify the issues associated with implementing the standard (auditors)

● Identify the issues associated with those responsible for internal controls (preparers)

3

SAS No. 112, Communicating Internal

Control Matters Identified in an Audit

4

About SAS No. 112

● Issued May 2006

● Supersedes SAS No. 60

● Effective for audits of financial statements for periods ending on or after December 15, 2006

● Fairly short; brief Appendix

5

The Quick Snapshot

● Requires auditor to communicate, in writing, significant deficiencies and material weaknesses to management and those charged with governance

6

Definitions

● Control deficiency

♦Design or operation of a control that does not prevent or detect misstatements

7

Definitions● Significant deficiency—Control

deficiency(ies) that adversely affects the entity’s financial reporting process such that there is more than a remote likelihood that a misstatement in the financial statements that is more than inconsequential will not be prevented or detected

8

Definitions

● Material weakness—Significant deficiency(ies) that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected

9

Definitions

● Those charged with governance—The person(s) with responsibility for the entity’s strategic direction and accountability, including the financial reporting process

10

Evaluating Control Deficiencies● The significance depends on the

potential for a misstatement, not an actual misstatement

● The absence of an identified misstatement does not provide evidence that a deficiency is not significant or material

11

● Nature of accounts, disclosures, and assertions

● Susceptibility to loss or fraud

● Subjectivity and complexity

● Cause and frequency of detected exceptions

Evaluating—Factors Affecting Likelihood

12

● Interaction or relationship of the control with other controls

● Interaction of deficiency with other deficiencies

● Possible future consequences of the deficiency

Evaluating—Factors Affecting Likelihood

13

Evaluating—Factors Affecting Magnitude● Financial statement amounts or

total transactions exposed

● Volume of activity in account balance or class of transactions affecting current or future periods

14

Evaluating—Other Considerations● Multiple control deficiencies that

affect the same financial statement account balance or disclosure

● Mitigating effects of effective compensating controls

● Results of tests of controls

15

Examples—Deficiencies That Are at Least Significant

Deficiencies in controls over:● Selection and application of GAAP● Antifraud programs● Nonroutine and nonsystematic

transactions● Period-end financial reporting process

16

Examples—Strong Indicators of Material Weaknesses

Presumptive requirement—significant deficiencies

● Ineffective oversight by those charged with governance

● Restatement of previously issued financial statements

● Material misstatement identified by the auditor

17

Examples—Strong Indicators of Material Weaknesses

Presumptive requirement—significant deficiencies

● Ineffective internal audit or risk assessment functions

● Ineffective regulatory compliance function, when applicable

● Any fraud by senior management

18

Examples—Strong Indicators of Material Weaknesses

Presumptive requirement—significant deficiencies

● Management’s failure to assess previously reported significant deficiencies

● Ineffective control environment

19

Communicating Deficiencies

● In writing● To management/governance● All significant deficiencies and

material weaknesses● Items reported in prior years, not yet

remediated● Within 60 days of report release date

20

Communicating Deficiencies

● Importance of early communications

● Management’s cost-benefit decisions does not relieve auditor responsibility

● Permits other matters to be communicated

21

Communicating Deficiencies

Content:

● Required elements

● Illustrative samples

● Management's written responses may be included

22

The Auditor’s Perspective

23

Impact on Auditors

● Timing

● Observations

● Concerns/Issues

24

Timing—Pre-SAS 112

Auditor’s report on financial statements

Management letters

Single Audit reports

Points for discussion

25

Timing—Using SAS 112

● All of these must now be communicated to management within 60 days after release date of our report on the CAFR/Basic Financial Statements

26

Timing—Using SAS 112

● Yellow Book report issued soon after CAFR, and not in our single audit report

● Management letter will also need to be issued within 60 days after our report on CAFR released

27

Our Experiment

● Take all the financial statement audits issued last year

● Summarize all findings into their four “buckets”

● Re-categorize the findings under the new criteria of SAS No. 112

28

Our Experiment

● Pre-SAS 112:Material weaknesses 3

Reportable conditions 11

Management letter 65

Points for discussion 340

Total 419

29

Our Experiment—Results

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Pre-SAS 112 Using SAS 112

Points for discussion Management letter items

Reportable conditions/significant deficiencies Material weaknesses

30

Our Experiment—Results

0 50 100 150 200 250 300 350 400

Pre-SAS112

Using SAS112

Material weaknesses 3 32

Reportable conditions/significantdeficiencies

11 156

Management letter items 65 78

Points for discussion 340 185

Pre-SAS 112 Using SAS 112

31

Observations

● Difference between government audits and other audits

♦Others—2 “vehicles” for reporting

♦Govt.—3 “vehicles” for reporting

32

Observations

● We noticed overlap with:

♦SAS No. 103

♦Risk Assessment Suite of Standards

♦Independence Standards

♦Government Auditing Standards

33

Observations

● Auditors need to make a clear change in their thought process

● Auditors may need to gather more information to make the SAS No. 112 determinations

34

Observations

● This will be a fresh look

35

Concerns/Issues

● Changing our process for Yellow Book reports and management letters

♦When to begin writing process

♦Sharing time for audit and writing

♦Getting auditee responses

36

● Developing clear understanding to assist in applying:

♦More than inconsequential

♦ “Reasonable” person

Concerns/Issues

37

● For Yellow Book audits, determining what goes in the management letter

Concerns/Issues

38

● Determining auditee’s inability to apply GAAP or prepare statements vs. choosing to have someone else do so (and other similar determinations)

Concerns/Issues

39

● Educating auditee (who’s job is it?)

♦Preparers

♦Management

♦Governing bodies

♦Employees responsible for performing control activities

Concerns/Issues

40

Management’s Perspective

41

Change in Perspective

● Former Points for Discussion now in Management Letter

● Former Reportable Conditions may now result in Qualified Opinion

● All without any change in operations

42

Change in Perspective

● Proposed Audit Adjustments

● Does this mean that Internal Controls were not effective in fairly presenting financial information?

● Sometimes methodology and approach differs

43

Application to Arizona

● Decentralized Environment

● 135 State agencies

● Some agencies have own system

● Some agencies have own financial statements

44

Application to Arizona

● Internal Controls combination of Statewide and Agency

● Reliance on Policies, Procedures, Communications

45

Application to Arizona

● Primary Concern: an Internal Control problem at a large agency or combination of agencies could now become a statewide Opinion Qualification

● Perception and Understanding of Importance of Internal Controls

46

Application to Arizona

● Planning and Preparation Essential

● Discuss with Auditors

● Coordinate with Agencies/CFOs

● Communication and Relationships Key

● Manage Expectations

47

Application to Arizona

Follow Common Project Cycle

● Plan

● Implement

● Evaluate

● Adjust as needed

48

Questions and Discussion