Implications of SAS 112 NCURA Regional Meeting Park City, Utah April 22-27, 2006

Agenda What is SAS 112? Implications for A133 Audit Examples of Key Controls How Campuses Can Prepare Q & A

What is SAS112? Statement of Auditing Standards that applies to not-for-profit entities Designed to make the standards used for audit of not-for-profits consistent with those already in place for public companies Effective Date – For years ending on or after December 15, 2006

Purpose of SAS 112 To establish a standard for determining seriousness of a control issue and classifying it into one of three categories:  control deficiency  significant deficiency  material weakness To ensure effectiveness of internal controls that impact financial statements

SAS 112 Deficiencies A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of control deficiencies A material weakness is a significant deficiency, or a combination of significant deficiencies

SAS Deficiencies—Illustrative Quantifications (Source: PwC) Classification of Deficiency Likelihood of: With Potential Magnitude of Misstatement*: Control DeficiencyRemote Less than a 5% to 10% Chance Inconsequential Less than a 0.1% to 0.2% or revenues or expenses Significant DeficiencyMore than remote More than a 5% to 10% chance More than inconsequential Greater than 0.1% to 0.2% of revenues or expenses Material WeaknessMore than remote More than a 5% to 10% chance Material Greater than 1.0% of revenues or expenses *The levels of magnitude are still under discussion and may be revised as practice evolves.

Implications for A133 Audit The GAO has adopted same definitions of control weaknesses in Yellow Book For key controls testing: an error rate of 1 in 50 is OK an error rate of 2 in 50 fails Note: Error = control failure not necessarily an accounting error Expectation is that there will be more significant deficiencies and material weaknesses than in the past.

How Campuses Can Prepare Controller’s Office –Interpret University Policies and Procedures and Regulations and Promote Best Practices –Act as a liaison between external auditors and departments –Agree upon key controls with external auditors –Provide guidance, key controls framework, and communication for SAS-112 implementation to departments

How Campuses Can Prepare (con’t) Departments –Identify and document applicable significant key controls in specific area(s) –Implement key controls –Document evidence of review for all levels when performed (signature and/or ) –Perform self-assessment and test key controls to ensure the key controls are in place Document evidence of review –Fix SAS 112 deficiencies when identified Document evidence of corrective action taken

Q & A