Communicating Identified Internal Control Related Matters in Audits
| Abbreviations Key |
| ASB: Auditing Standards Board |
| SAS 115: Statement on Auditing Standards No. 115, Communicating Internal Control Related Matters Identified in an Audit |
| SAS 112: Statement on Auditing Standards No. 112, Communicating Internal Control Related Matters Identified in an Audit |
| FASB: Financial Accounting Standards Board |
| FAS 5: FASB Financial Accounting Standard No. 5, Accounting for Contingencies |
The ASB issued SAS 115 in October 2008, which supersedes SAS 112 for periods ending on or after December 15, 2009. Early implementation of the new standard is permitted.
SAS 115 establishes standards and provides guidance on communicating matters related to an entity’s internal control over financial reporting identified during an audit of financial statements. The new standard:
- Defines the terms deficiency in internal control, significant deficiency, and material weakness
- Provides guidance on evaluating the severity of identified deficiencies in internal control
- Requires written communication of significant deficiencies and material weaknesses identified by the auditor to those charged with governance
What has changed under SAS 115?
There are four significant differences between SAS 115 and SAS 112:
- Material weakness has been redefined, but there are no substantive changes.
- SAS 115 uses the terminology “reasonable possibility” rather than “a more than remote likelihood.”
- In SAS 115, a reasonable possibility exists when the likelihood of the event is either reasonably possible or probable as those terms are used in FAS 5. Thus, a “reasonable possibility” is the same as “a more than remote likelihood.”
| |
SAS 115
|
SAS 112
|
| Definition of a material weakness |
“A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.” |
“A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the entity’s internal control.” |
- Significant deficiency has been redefined.
- SAS 115 defines significant deficiencies as deficiencies that are less severe than a material weakness, yet important enough to merit attention by those charged with governance.
- “More professional judgment is necessary when evaluating significant deficiencies because SAS 115 does not provide objective criteria for evaluating the probability and magnitude of those deficiencies that are not considered material weaknesses,” states Mike Westervelt, an assurance and accounting manager with LarsonAllen.
| |
SAS 115
|
SAS 112
|
| Definition of a significant deficiency |
“A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.” |
“A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity’s financial statements that is more than inconsequential will not be prevented or detected by the organization’s internal control.” |
- Several changes were made regarding the communication of internal control related matters identified in an audit.
- The order of the items communicated was changed so that material weaknesses will precede significant deficiencies.
- Include the new definition of a material weakness and, where relevant, the new definition of a significant deficiency. (SAS 112 required the inclusion of the definition of a significant deficiency, and where relevant, the definition of a material weakness.)
- Include an additional statement that “the auditor’s consideration of internal control was not designed to identify all deficiencies in internal control that might be significant deficiencies or material weaknesses.”
- Communicate all significant deficiencies and material weaknesses identified, including those remediated during the audit.
- Compensating controls
- SAS 115 clarifies when a control should be considered a compensating control. Auditors may identify a deficiency when performing substantive procedures or testing the operating effectiveness of controls. Management may inform the auditor of the existence of compensating controls that, if effective, may limit the severity of the deficiency.
- In accordance with SAS 115, the auditor is not required to consider compensating controls, but may do so by testing the effectiveness of the compensating controls to limit the severity of the deficiency. Although compensating controls can limit the severity of a deficiency, they do not eliminate the deficiency.
What has not changed under SAS 115?
SAS 115 retains many of the SAS 112 requirements.
- Indicators of material weaknesses include:
- Identification of fraud by senior management
- Restatement of previously issued financial statements
- Auditor discovered material adjustments
- Ineffective oversight by those charged with governance
- An entity’s inability to prepare or review financial statements is a strong indicator of a material weakness.
- Auditors should consider qualitative and quantitative factors when evaluating the magnitude and likelihood of deficiencies.
- Auditors should consider whether prudent officials having knowledge of the same facts and circumstances, would reach the same conclusion when classifying deficiencies.
- Significant deficiencies and material weaknesses that were previously communicated and have not yet been remediated may be communicated, in writing, by referring to the previous written communication and the date of the communication.
- Although SAS 115 allows more auditor judgment than SAS 112 when determining whether deficiencies are significant, if an evaluation was made that a control deficiency was a material weakness or significant deficiency in the prior year, the severity should not be lowered unless new controls were put in place.
- Written communication is best made by the report release date (release of the financial statements), but should be made no later than 60 days following this date.
- The existence of significant deficiencies or material weaknesses may already be known and may represent a conscious decision by management or those charged with governance to accept the risk associated with the deficiencies because of cost or other considerations. Management is responsible for making decisions concerning costs to be incurred and related benefits. The auditor’s responsibility is to communicate significant deficiencies and material weaknesses regardless of management’s decisions.
For more information, contact us.