EVALUATING THE IMPACT OF NEW AUDIT STANDARDS

One of the many responsibilities of a company today is working closely with auditors.  Companies must understand the broader context for an auditor’s work and develop a successful rapport with their auditor.  It is not enough anymore to just let the auditor do the job.  Companies have to understand the standards under which their auditors practice in order to communicate effectively and produce positive outcomes. 

A Statement on Auditing Standards (SAS) provides guidance to auditors as to how to plan, perform, and report on financial statement audits.  A new SAS primarily impacts auditors and how they conduct auditing procedures.  On occasion, a new SAS will be so expansive in nature that it will have a noticeable impact from a client’s perspective.  SAS No. 112 Communicating Internal Control Related Matters in an Audit, effective for fiscal years ending on or after December 15, 2006, is one of those standards.

Although this is not a complete description of the standard and its requirements, here are three highlights from SAS No. 112 that clients should consider:

1. Communications must now be made in writing.  The old standard allowed for verbal communication of internal control related matters (i.e. at a Board of Director’s meeting, with executive management in an audit exit interview, or in a similar setting).  Verbal rather than written communication might be preferred for a variety of reasons – e.g., lower audit fees, an assessment that the points were minor and need not be in writing, etc.  The requirement to put internal control related matters in writing eliminates the option of simple verbal communication.

2. The definitions and titles of control issues have been changed to more closely match the wording required for public companies.  In short, a Control Deficiency exists when the design or operation of internal controls will not prevent or detect errors on a timely basis.  A Significant Deficiency is a control deficiency where the likelihood is more than remote that the error would be “more than inconsequential” to the financial statements.  Lastly, a Material Weakness is a control deficiency where the likelihood is more than remote that the error would be “material” to the financial statements.  A deficiency in either category must be reported – in writing - by the auditor.

3. The standard provides a list of matters which, in most instances and at a minimum, would result in a Significant Deficiency.  This list includes: restatement of previously issued financial statements; a material audit adjustment not first identified by the client; a repeat internal control deficiency where management took no action to correct the previously communicated deficiency; etc.  This term replaces Reportable Condition and provides a lower threshold – i.e., more likelihood – for internal control matters to be identified as deficiencies.

Because of SAS No. 112, many non-public companies and nonprofit entities will now be receiving an internal control report discussing deficiencies and recommendations for the first time.  This, however, is intended to be a positive step – a better attempt by the CPA profession to communicate such matters identified during an audit, to an entity’s management and governance group.  This will hopefully improve financial reporting for all users over time.