AICPA SAS 112: Case studies and Intermediate Reporting Issues

1. AICPA SAS 112:Case studies and Intermediate Reporting Issues Presented by Frank Crawford, CPA Crawford & Associates, P.C. www.crawfordcpas.com frank@crawfordcpas.com

2. Pocket Guide to SAS 112… REMOTE S REMOTE M REMOTE L MORE THAN REMOTE S MORE THAN REMOTE M MORE THAN REMOTE L CONTROL DEFICIENCY SIGNIFICANT DEFICIENCY MATERIAL WEAKNESS Communicate in Writing

3. Pocket Guide to SAS 112 for Financial Statements:What is the Likelihood of a potential misstatement, and what is the Magnitude of the potential misstatement? REMOTE S REMOTE M REMOTE L MORE THAN REMOTE S MORE THAN REMOTE M MORE THAN REMOTE L CONTROL DEFICIENCY SIGNIFICANT DEFICIENCY MATERIAL WEAKNESS Communicate in Writing

4. Pocket Guide to SAS 112 for Single Audit (A-133):What is the Likelihood of potential noncompliance with a type of compliance requirement of a federal program, and what is the Magnitude of the potential noncompliance? REMOTE S REMOTE M REMOTE L MORE THAN REMOTE S MORE THAN REMOTE M MORE THAN REMOTE L CONTROL DEFICIENCY SIGNIFICANT DEFICIENCY MATERIAL WEAKNESS Communicate in Writing

5. Major points of SAS 112 • The financial statement auditor cannot be part of the auditee’s internal control • What the financial statement auditor does on behalf of or for the auditee (drafting financial statements and notes, calculating depreciation, etc…) is not considered a substitute for management’s internal control, and doesn’t count in the auditor’s evaluation of the severity of the internal control deficiency • Prudent official test could overrule the financial statement auditor’s judgment about the severity of a control deficiency or significant deficiency

6. Auditor’s Responsibilities • In an audit of financial statements under GAAS and GAGAS, the auditor: • is not required to identify deficiencies in internal control • is not required to express an opinion on internal control effectiveness • is required to understand controls in assessing risk of misstatements • is required to test internal controls for effectiveness, if they intend to rely on the controls to reduce audit work • SAS 112 did not change these requirements

7. In a Nutshell, SAS No. 112… • Defines the terms control deficiencies, significant deficiencies and material weaknesses and conforms those definitions to those in PCAOB AS#2 • Provides guidance for auditors on evaluating the severity of control deficiencies • Requires the auditor to communicate, in writing, to management and those charged with governance all significant deficiencies and material weaknesses (Should be communicated even if they were communicated in connection with previous audits and are still applicable) • Effective date = audits of periods ending on or after December 15, 2006

8. OLD DEFINITION Not defined. NEW DEFINITION A control deficiency exists when the design or operation of a control does not allow management or employees, in the course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Control Deficiency

9. Internal Control Components • Control deficiencies may involve one or more of the five interrelated components of internal control (SAS 55) • Control environment • Risk assessment • Control activities • Information and communication • Monitoring

10. OLD DEFINITION A reportable condition involves a matter coming to the auditors attention relating to significant deficiencies in the design or operation of the internal control that, in the auditor’s judgment, could adversely affect the organization’s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements. NEW DEFINITION A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP, such that there is more than a remotelikelihood that a misstatement of the entity’s financial statements that is more than inconsequential will not be prevented or detected. Significant Deficiency

11. Remote Likelihood • Remote likelihood has the same meaning as in FASB Statement No. 5 • Probable – the future event is likely to occur • Reasonably possible – the chance of the future event occurring is more than remote but less than likely • Remote – the chance of the future event occurring is slight • Therefore, the likelihood of an event is “more than remote” when it is reasonably possible or probable

12. More Than Inconsequential • More than inconsequential describes the magnitude of potential misstatement that could occur as a result of a significant deficiency • Misstatement is “inconsequential” if a reasonable person would conclude would clearly be immaterial to the financial statements • In determining whether potential misstatement would be more than inconsequential, auditor should consider qualitative and quantitative factors • A potential misstatement may be inconsequential quantitatively, but may still be considered more than inconsequential due to qualitative factors

13. Quantitative Factors • Interpretation No. 3 – Quantitative Measures of Materiality in Evaluating Audit Findings, to SAS 47 - Audit Risk and Materiality in Conducting an Audit • Matter of auditor’s professional judgment • Overall financial statement material is based on a percentage or dollar amount related to an element or elements in the financial statements for “each opinion unit” that are expected to affect the judgment of a reasonable person relying on and using the statements (generally considered 0.5% - 5.0% of opinion unit base) • In government entities, total assets, total revenues, or fund balance/net assets are often important and widely-used elements or bases • SAS 112, paragraph 8, uses 20% of overall financial statement materiality to define clearly immaterial (inconsequential)

14. Qualitative Factors • Interpretation No. 4 – Considering the Qualitative Characteristics of Misstatements, to SAS 47 - Audit Risk and Materiality in Conducting an Audit • Matter of auditor’s professional judgment influenced by the auditor’s perception of the needs of a reasonable person using the statements • Qualitative factors for consideration include: • A misstatement that turns a net loss into net income • A misstatement in turns a negative unrestricted net assets to a positive amount • A misclassification that turns a negative budget variance into a positive variance

15. Qualitative Factors (Cont.) • Qualitative factors for consideration include: • Potential effect of misstatement on compliance with debt covenants or important regulatory requirements • Misstatement that rewards management for performance (bonus, job retention, political promise) • Misstatement that would result in avoiding a single audit when required • Sensitivity of circumstances surrounding the misstatement, such as fraud, abuse, etc. • A misstatement that has implications on motivations or integrity of management • The risk of additional undetected misstatements

16. OLD DEFINITION A material weakness is a reportable condition in which the design or operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements caused by error or fraud in amounts that would be material in relation to the financial statements being audited may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions. NEW DEFINITION A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected. Material Weakness

17. Evaluating Deficiencies • Auditor should also evaluate possible mitigating effects of effective “compensating controls” • A compensating control limits the severity of the control deficiency (i.e. keeping it from reaching a significant deficiency or material weakness) • Compensating controls can mitigate the effects of a control deficiency, but do not eliminate the deficiency • To consider compensating controls in their evaluation, auditors must test the controls for effectiveness

18. Compensating Controls • Preventive Control Deficiency • Lack of segregation of duties over payables and disbursements • Compensating Detective Control • Executive level review of all disbursements made in excess of $1,000 in books and bank statements

19. Written Communication • Written communication required no later than 60 days following issuance of audit report (including deficiencies that were communicated in previous audits) • Auditor may decide communicate certain deficiencies during the audit • SAS 112 includes an appendix containing examples of circumstances that may be control deficiencies, significant deficiencies, or material weaknesses

20. Management Letter • Also states that nothing precludes the auditor from communicating to management and those charged with governance other matters that the auditor: • Believes to be of potential benefit to the entity • Has been requested to communicate • Such a communication can be done orally or in writing

21. On to the case studies…