Communicating Internal Control Matters – (2 of 2)

As a recap from Communicating Internal Control Matters post #1 of 2, the AICPA Statement on Auditing Standards (SAS) No. 112, Communicating Internal Control Related Matters Identified in an Audit - establishes new standards relating to the auditor's responsibility to communicate to an entity's management and to individuals charged with the entity's governance significant deficiencies and material weaknesses identified during the course of an audit of the entity's financial statements.

What are significant deficiencies and material weaknesses? First let’s define a control deficiency…According to the AICPA,
·..A control deficiency exists when the design or operation of a control does not allow the entity's management (or other employees), while performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is defined as one or more control deficiencies that adversely affect the entity's ability to initiate, authorize, record, process, or report reliably financial data in accordance with GAAP, resulting in more than a remote likelihood that a financial statement misstatement deemed “more than inconsequential” will not be prevented or detected. A material weakness is defined as one or more significant deficiencies that result in more than a remote likelihood that a material misstatement will not be prevented or detected.

What are some of the areas that management should identify as potential deficiencies??
— Ineffective oversight of the entity's internal control over financial reporting.

— The restatement of previously issued financial statements to correct a material misstatement.

— Identification by the auditor of a material misstatement in the current period's financial statements that was not initially identified by the entity's internal controls.

— An ineffective internal audit or risk assessment function.

— For complex entities operating in highly regulated industries, an ineffective regulatory compliance function.

— Identification by senior management of fraud of any magnitude.

— Failure on the part of the entity's management or on the part of individuals charged with the entity's governance to assess the effect of a significant deficiency that has been communicated to them and their failure either to correct such deficiency or to conclude that it will not be corrected.

—An ineffective control environment.

Under this new auditing standard, the auditor is required to communicate to the entity's management and to individuals charged with governance significant deficiencies and material weaknesses identified in the course of the audit. This auditing standard is affective for years ending after December 16, 2006.