The AICPA recently issued a new auditing standard, SAS 112, Communicating Internal Control Related Matters Identified in an Audit. This new standard replaces a similar one. It contains, however, new guidance and terminology. It will require auditors to:
- Evaluate identified control deficiencies and determine whether these deficiencies, individually or in combination are significant deficiencies or material weaknesses.
- Communicate in writing to management and those charged with governance (such as the board of directors, audit committee, governing body or equivalent body), as part of each audit, control deficiencies that are considered significant deficiencies or material weaknesses, including those identified in previous audits that have not yet been remediated.
This standard and its interpretive guidance emphasize that management is responsible for establishing, maintaining and monitoring internal controls and is responsible for the fair presentation in the financial statements of financial position, results of operations and cash flows, including the notes to financial statements, in conformity with US Generally Accepted Accounting Principals (GAAP). The auditor cannot be a part of the internal controls. THEREFORE, MANAGEMENT MUST EXPECT TO BECOME MORE INVOLVED IN THE PREPARATION OF ITS FINANCIAL STATEMENTS, INCLUDING THE NOTES.
Management may already be aware of significant deficiencies or material weaknesses and may have made a conscious decision, along with the governing body, to accept that degree of risk because of cost considerations. It is management’s responsibility to make decisions concerning costs to be incurred and related benefits. It is the auditors’ responsibility to communicate significant deficiencies and material weaknesses in accordance with professional standards, regardless of management’s decisions.
With new definitions of significant deficiencies (previously called reportable conditions) and material weakness, auditors may report more control deficiencies to you than in the past. As they assess any identified control deficiencies, they will evaluate their significance based on their potential to cause a misstatement of the financial statements rather than whether a misstatement has actually occurred.
Management will be forced to make adjustments as it becomes more comfortable with this new standard. In the long run, it will force management and governing bodies to become more involved in the financial operations of the entity which could become a significant benefit.