CPA Firm Support Services, LLC
Columnist
Share this content
AccountingWEB

Clarified Auditing Standards: Internal Control Related Matters—Part 2

by
Mar 25th 2015
CPA Firm Support Services, LLC
Columnist
Share this content

In this article, we’ll look at determining reportable control deficiencies under AU-C Section 265. According to the guidance, only significant deficiencies and material weaknesses are required to be included in the internal control communication letter. Significant deficiencies and material weaknesses arise from risks of material misstatements.

For small audits, risks of material misstatements are primarily the absence of key controls at the entity level – either in design or in operation. For larger entities with more accounting personnel, key controls will exist at both the entity and activity levels. An identified risk of material misstatement will be reported to management in the internal control letter, even though it may have been corrected.

To facilitate the risk assessment process, and the ultimate reporting of significant deficiencies and material weaknesses, it is imperative key controls be identified and evaluated during the planning and risk assessment phases of an audit. Based on internal control documentation, identified risks will impact the development of cost-beneficial audit strategies, the audit plan (program), and the internal control communication letter.

Reporting Deficiencies in Subsequent Years
For some smaller clients, changes in accounting policies and procedures are slow. Employees who lack necessary qualifications to make accounting or internal control decisions, have no free time to design and administer internal control improvements, and lack understanding of the importance of internal controls, among other reasons, can hinder reception of an auditor’s suggestions for improving internal controls.

In these situations, AU-C Section 265 requires reporting significant weaknesses and material weaknesses until management takes appropriate corrective action. If an auditor’s attempts to help a client improve are not acknowledged or acted on, or if the recommendations to correct deficiencies are not considered practical by management, the suggestions must be communicated in the letter each year after the first.

Suggestions that may fall into this area are:

  • Significant deficiencies:
    • Management's expertise for selecting and applying accounting principles is lacking.
    • No designed or operating anti-fraud programs.
    • No controls over unusual or extraordinary transactions.
    • No controls over monthly or annual closing in the financial reporting process.
  • Material weaknesses:
    • Ineffective governance over controls and reporting.
    • Material misstatements requiring adjustment.
    • Identification of any management fraud.
    • Management's failure to assess the effects of previous deficiencies and take action or decide not to take action.
    • A large number of control deficiencies indicating a weak control environment.

Illustrative Internal Control Communication Letter

To: Don West, President
Always Best Corporation

In planning and performing our audit of the financial statements of Always Best Corporation (the “Corporation”) as of and for the year ended December 31, 2015, in accordance with auditing standards generally accepted in the United States of America, we considered the Corporation's internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the Corporation's internal control. Accordingly, we do not express an opinion on the effectiveness of the Corporation's internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and, therefore, material weaknesses or significant deficiencies may exist that were not identified. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses or significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis.

We consider the following deficiencies in the Corporation's internal control to be material weaknesses (actual letter descriptions would be specific and describe potential effects):

  • Ineffective governance over controls and reporting.
  • Material misstatements requiring adjustment.
  • Identification of any management fraud.
  • Management’s failure to assess the effects of previous deficiencies and take action or decide not to take action.
  • A large number of control deficiencies indicating a weak control environment.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. We consider the following deficiencies in the Company's internal control to be significant deficiencies (actual letter descriptions would be specific and describe potential effects):

  • Management’s expertise for selecting and applying accounting principles is lacking.
  • No designed or operating anti-fraud programs.
  • No controls over unusual or extraordinary transactions.
  • No controls over monthly or annual closing in the financial reporting process.

(When only significant deficiencies are being communicated, a statement would be added indicating none of the significant deficiencies are material weaknesses.)

This communication is intended solely for the information and use of management and the board of directors of Always Best Corporation.

Largess Ottiter & Co. CPAs
Anywhere, USA
March 15, 2016

(The letter should be issued within 60 days of the report release date, which is the final date for completing and locking down engagement files.)

My exclusive presentation of webcasts on CPEcredit.com and self-study courses covering various applications of auditing standards can be accessed by clicking the appropriate box on the left side of my home page, www.cpafirmsupport.com. Registered users on my website receive a 20 percent discount on CPE materials presented by myself and numerous other authors on a variety of professional topics.

My assistance in CPA firm quality-control consulting, audit planning, and peer-review preparation can be obtained by sending an email using the “Contact Us” tab on my home page.

Tags:

Replies (0)

Please login or register to join the discussion.

There are currently no replies, be the first to post a reply.