1. 1 AICPA Statement on Auditing Standards No. 112, Communicating Internal Control Matters Identified in an Audit NASACT Audio Conference October 19, 2006

2. 2 Objectives Know the key concepts for this recently issued audit standard Identify the issues associated with implementing the standard (auditors) Identify the issues associated with those responsible for internal controls (preparers)

3. 3 SAS No. 112, Communicating Internal Control Matters Identified in an Audit

4. 4 About SAS No. 112 Issued May 2006 Supersedes SAS No. 60 Effective for audits of financial statements for periods ending on or after December 15, 2006 Fairly short; brief Appendix

5. 5 The Quick Snapshot Requires auditor to communicate, in writing, significant deficiencies and material weaknesses to management and those charged with governance

6. 6 Definitions Control deficiency Design or operation of a control that does not prevent or detect misstatements

7. 7 Definitions Significant deficiencyControl deficiency(ies) that adversely affects the entitys financial reporting process such that there is more than a remote likelihood that a misstatement in the financial statements that is more than inconsequential will not be prevented or detected

8. 8 Definitions Material weaknessSignificant deficiency(ies) that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected

9. 9 Definitions Those charged with governance The person(s) with responsibility for the entitys strategic direction and accountability, including the financial reporting process

10. 10 Evaluating Control Deficiencies The significance depends on the potential for a misstatement, not an actual misstatement The absence of an identified misstatement does not provide evidence that a deficiency is not significant or material

11. 11 Nature of accounts, disclosures, and assertions Susceptibility to loss or fraud Subjectivity and complexity Cause and frequency of detected exceptions EvaluatingFactors Affecting Likelihood

12. 12 Interaction or relationship of the control with other controls Interaction of deficiency with other deficiencies Possible future consequences of the deficiency EvaluatingFactors Affecting Likelihood

13. 13 EvaluatingFactors Affecting Magnitude Financial statement amounts or total transactions exposed Volume of activity in account balance or class of transactions affecting current or future periods

14. 14 EvaluatingOther Considerations Multiple control deficiencies that affect the same financial statement account balance or disclosure Mitigating effects of effective compensating controls Results of tests of controls

15. 15 ExamplesDeficiencies That Are at Least Significant Deficiencies in controls over: Selection and application of GAAP Antifraud programs Nonroutine and nonsystematic transactions Period-end financial reporting process

16. 16 ExamplesStrong Indicators of Material Weaknesses Presumptive requirementsignificant deficiencies Ineffective oversight by those charged with governance Restatement of previously issued financial statements Material misstatement identified by the auditor

17. 17 ExamplesStrong Indicators of Material Weaknesses Presumptive requirementsignificant deficiencies Ineffective internal audit or risk assessment functions Ineffective regulatory compliance function, when applicable Any fraud by senior management

18. 18 ExamplesStrong Indicators of Material Weaknesses Presumptive requirementsignificant deficiencies Managements failure to assess previously reported significant deficiencies Ineffective control environment

19. 19 Communicating Deficiencies In writing To management/governance All significant deficiencies and material weaknesses Items reported in prior years, not yet remediated Within 60 days of report release date

20. 20 Communicating Deficiencies Importance of early communications Managements cost-benefit decisions does not relieve auditor responsibility Permits other matters to be communicated

21. 21 Communicating Deficiencies Content: Required elements Illustrative samples Management's written responses may be included

22. 22 The Auditors Perspective

23. 23 Impact on Auditors Timing Observations Concerns/Issues

24. 24 TimingPre-SAS 112 Auditors report on financial statements Management letters Single Audit reports Points for discussion

25. 25 TimingUsing SAS 112 All of these must now be communicated to management within 60 days after release date of our report on the CAFR/Basic Financial Statements

26. 26 TimingUsing SAS 112 Yellow Book report issued soon after CAFR, and not in our single audit report Management letter will also need to be issued within 60 days after our report on CAFR released

27. 27 Our Experiment Take all the financial statement audits issued last year Summarize all findings into their four buckets Re-categorize the findings under the new criteria of SAS No. 112

28. 28 Our Experiment Pre-SAS 112: Material weaknesses3 Reportable conditions11 Management letter65 Points for discussion340 Total419

29. 29 Our ExperimentResults 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Pre-SAS 112Using SAS 112 Points for discussionManagement letter items Reportable conditions/significant deficienciesMaterial weaknesses

30. 30 Our ExperimentResults 050100150200250300350400 Pre-SAS 112 Using SAS 112 Material weaknesses 332 Reportable conditions/significant deficiencies 11156 Management letter items 6578 Points for discussion 340185 Pre-SAS 112Using SAS 112

31. 31 Observations Difference between government audits and other audits Others2 vehicles for reporting Govt.3 vehicles for reporting

32. 32 Observations We noticed overlap with: SAS No. 103 Risk Assessment Suite of Standards Independence Standards Government Auditing Standards

33. 33 Observations Auditors need to make a clear change in their thought process Auditors may need to gather more information to make the SAS No. 112 determinations

34. 34 Observations This will be a fresh look

35. 35 Concerns/Issues Changing our process for Yellow Book reports and management letters When to begin writing process Sharing time for audit and writing Getting auditee responses

36. 36 Developing clear understanding to assist in applying: More than inconsequential Reasonable person Concerns/Issues

37. 37 For Yellow Book audits, determining what goes in the management letter Concerns/Issues

38. 38 Determining auditees inability to apply GAAP or prepare statements vs. choosing to have someone else do so (and other similar determinations) Concerns/Issues

39. 39 Educating auditee (whos job is it?) Preparers Management Governing bodies Employees responsible for performing control activities Concerns/Issues

40. 40 Managements Perspective

41. 41 Change in Perspective Former Points for Discussion now in Management Letter Former Reportable Conditions may now result in Qualified Opinion All without any change in operations

42. 42 Change in Perspective Proposed Audit Adjustments Does this mean that Internal Controls were not effective in fairly presenting financial information? Sometimes methodology and approach differs

43. 43 Application to Arizona Decentralized Environment 135 State agencies Some agencies have own system Some agencies have own financial statements

44. 44 Application to Arizona Internal Controls combination of Statewide and Agency Reliance on Policies, Procedures, Communications

45. 45 Application to Arizona Primary Concern: an Internal Control problem at a large agency or combination of agencies could now become a statewide Opinion Qualification Perception and Understanding of Importance of Internal Controls

46. 46 Application to Arizona Planning and Preparation Essential Discuss with Auditors Coordinate with Agencies/CFOs Communication and Relationships Key Manage Expectations

47. 47 Application to Arizona Follow Common Project Cycle Plan Implement Evaluate Adjust as needed

48. 48 Questions and Discussion