Statement on Auditing Standards (SAS) 112 Communicating Internal Control Related Matters Identified in an Audit

SAS 112 Effective date – June 30, 2007 Issued in May 2006 Objectives  Define internal control deficiencies  Define the auditor’s reporting requirements Impact

SAS 112 – Impact Internal Control  Process  Reasonable assurance of financial reporting  Safeguarding assets  Consists of 5 interrelated components (COSO)

SAS 112 – Impact COSO

SAS 112 – Impact Auditor Scope of Internal Control (I/C)  No expression of an opinion  Must consider the internal control in the nature, timing and extent of audit procedures  May place reliance on the I/C  Must test controls of major federal program under the single audit

SAS 112 – Type of Deficiencies Material Weakness Significant Deficiency Control Deficiency

SAS 112 – Type of Deficiencies Control Deficiency  “exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.”  Design deficiency  Operation deficiency

SAS 112 – Type of Deficiencies Significant Deficiency  “a control deficiency or combination of deficiencies that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP such that there is more than a remote likelihood that a misstatement of the f/s that is more than inconsequential will not be prevented or detected.”

SAS 112 – Type of Deficiencies Significant Deficiency, cont’d  More than remote likelihood – Chance of an event occurring is more than slight but less than likely Reasonably possible  More than inconsequential – “Prudent official, reasonable person” concept Quantitative and qualitative assessment Approximately 20% of tolerable misstatement

SAS 112 – Type of Deficiencies Material Weakness  A significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the f/s will not be prevented or detected.

SAS 112 – Previous Definitions Material Weakness (SAS 60)  A reportable condition in which the design or operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements caused by error or fraud in amounts that would be material in relation to the financial statements being audited may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions.

SAS 112 vs. SAS 60 Material Weakness Significant Deficiency Control Deficiency Material Weakness Reportable Condition Mgmt Letter Comment SAS 112SAS 60

Evaluating Control Deficiencies Evaluation:  Depends on the potential for misstatement Management Acceptance:  Conscious decisions on the part of management to accept a degree of risk does not preclude auditor communication

Evaluating Control Deficiencies Examples of significant deficiencies:  Inadequate selection and application of GAAP  Lack of antifraud programs and controls  Lack of controls over non-routine transactions  Lack of controls over period end financial reporting

Evaluating Control Deficiencies Examples of material weaknesses:  Restatement of previously issued financial statements or prior-period adjustments  Identification of a misstatement by the auditor (not initially detected by I/C)  Ineffective risk assessment function  Ineffective compliance monitoring  Failure to assess previous deficiencies

Auditor Reporting Significant deficiencies and material weaknesses must be reported to “those charged with governance” Communication is best made by the report release date but should be made no later than 60 days following the release date

Concluding Remarks SAS 112 is not just an Auditor-Controller (A/C) issue  Good internal control is a County-wide responsibility  Timely coordination with departments and A/C office is key

Questions?