New auditing standards address internal controls

Regular financial audits are a must for every nonprofit. This is true for a number of reasons, not the least of which is upholding the accountability of your organization. (See “Accountability is critical for today’s nonprofits” on page 2.) Well, some audit standards have changed.

For example, last year, the Auditing Standards Board issued Statement on Auditing Standards (SAS) No. 112, Communicating Internal Control Related Matters Identified in an Audit. It addresses just how auditors should communicate certain issues related to internal controls over financial reporting that may be identified during a financial statement audit.

Defining deficiencies

SAS 112 focuses on “control deficiencies” — that is, shortcomings in your internal financial controls. More specifically, it breaks down control deficiencies into two primary types:

1. Significant deficiency. This is one or more control deficiencies that hinder your ability to “initiate, authorize, record, process, or report financial data reliably.” In other words, these deficiencies prevent you from generating financial data under generally accepted accounting principles to the extent that there’s “more than a remote likelihood” that your financial statements will contain a more-than-inconsequential misstatement that won’t be prevented or detected.
2. Material weakness. This is one or more significant deficiencies that make it more than likely that your financial statements will contain a material misstatement that won’t be prevented or detected.

Judging the seriousness

Along with defining control deficiencies, SAS 112 provides guidance to auditors on how they can judge the seriousness of a deficiency should it show up during an audit. (And it makes clear that the controls in question are not restricted to the general ledger but include any related to the preparation of the financial statements.)

To this end, SAS 112 gives some examples of indicators of control deficiencies. These include situations when an auditor:

• Finds any restatement of previously issued financial statements that was issued to reflect the correction of a material misstatement,
• Identifies a material misstatement that went previously unidentified by the entity’s internal controls,
• Learns that management (or those charged with governance) has failed to gauge the effect of a previously revealed significant deficiency and to either fix the problem or deem that it will go unfixed,
• Discovers a lack of segregation of duties with a significant account or process, or
• Detects no or inadequate controls in place to protect a given asset.

Bear in mind that, initially, a control deficiency is presumably a material weakness, but an auditor may discover further information that warrants downgrading it to a significant or inconsequential deficiency.

Also note that SAS 112 doesn’t mandate auditors to specifically look for control deficiencies. Instead, it requires auditors to evaluate such deficiencies once identified. If an auditor does find a control deficiency, he or she must notify management (or those charged with governance) of any significant deficiencies and material weaknesses — in writing — no more than 60 days after issuing the audit report. If there are mitigating controls, deficiencies may not need to be reported.

Discussing the changes

SAS 112 is effective for periods ending on or after Dec. 15, 2006, and applies whenever an auditor expresses an opinion on financial statements — including a disclaimer of opinion. If you’ve yet to do so, discuss with your auditor just how the changes wrought by SAS 112 could affect your nonprofit’s financial statements. •