The audit is complete, the audit report says the financial statements “present fairly”, so that’s that. You don’t have to think about an audit again until next year, right? But wait, what’s this other report? Communication with those charged with governance? Communication of a material weakness or significant deficiency? Should you be concerned about these? Let’s find out.
You probably know that your financial statements need to be prepared in accordance with generally accepted accounting principles (or GAAP), but there are also generally accepted auditing standards (or GAAS). GAAP exists so that financial statements are stated correctly and understandable to the readers. GAAS exists so that all audits are conducted with the same standards. GAAS also gives us as your auditor guidance on what needs to be reported and how it needs to be reported. The auditing standards board of the AICPA sets the standards by issuing “statements on auditing standards” commonly abbreviated as SAS. The communications with those charged with governance are covered by SAS 114 and SAS 115. These communications are separate from the audit report and allow the auditor to communicate findings and other matters with you that don’t result in a modification of the audit opinion, but still warrant your attention.
What is the Governance Letter? (SAS 114)
This letter is required for all audits and its purpose is to communicate to you (Board of Directors, Audit Committee, President, or Management, etc.) the following:
- The scope of the audit procedures we performed
- Any significant risks we identified
- Significant accounting estimates
- Other information, such as any disagreements with management, significant unusual transactions, or other difficulties encountered
This letter also communicates the adjustments that were made during the audit.
We present these to our clients, so they are aware of the adjustments we made, but also to communicate and quantify known errors that were found during the audit.
Some adjustments may be routine, others may be of concern. In either case, we are always willing to help you understand the adjustments and why we made them.
What is the Communication on Internal Controls? (SAS 115)
As part of the audit, auditors are required to gain an understanding of your internal controls, how they are implemented, and their effectiveness. Internal controls are the policies, procedures, mechanisms, and systems your organization has put in place to ensure that the accounting records are complete and accurate. In some cases, one or more internal controls may not be operating effectively or may not exist at all. In those cases, auditors will issue a SAS 115 letter.
While we would have discussed any issues we found during the audit with our client’s management, we are also required to communicate them in writing.
Internal control issues can include things like lack of segregation of duties, inadequately trained accounting personnel, inability to prepare financial statements, and material audit adjustments. Depending on the severity, these issues fall into one of two buckets. They may be either significant deficiencies or material weaknesses.
What Is a Significant Deficiency or Material Weakness?
Of the two, a material weakness is more severe. A material weakness is defined by SAS 115 as “a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.” In essence, a material weakness exists when one or more internal controls fails or does not exist, resulting in a likelihood that an error will occur.
A significant deficiency is “a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.” If you receive a significant deficiency, it means that your organization does not yet have a material weakness, but if the deficiency is not corrected or mitigated in some way, it may eventually create a material weakness.
You Have a Significant Deficiency or Material Weakness, Now What?
In general, you should try to correct the issue if possible. Some issues are not practical to correct depending on the size of your organization, but you can create additional controls to help reduce the risk of errors.
As part of the communication of the deficiency or weakness, we will also give recommendations on how your organization can address the findings.
If you have additional questions or concerns you should contact your auditor and we will be glad to work with you on strengthening your internal controls.
