Statement on Auditing Standards (SAS) 112

Communicating Internal Control Related Matters Identified in an Audit

SAS 112

Effective date – June 30, 2007 Issued in May 2006 Objectives

Define internal control deficienciesDefine the auditor’s reporting requirements

Impact

SAS 112 – Impact

Internal Control ProcessReasonable assurance of financial reportingSafeguarding assetsConsists of 5 interrelated components

(COSO)

SAS 112 – Impact

COSO

SAS 112 – Impact

Auditor Scope of Internal Control (I/C)No expression of an opinionMust consider the internal control in the

nature, timing and extent of audit proceduresMay place reliance on the I/C Must test controls of major federal program

under the single audit

SAS 112 – Type of Deficiencies

Material Weakness Significant Deficiency Control Deficiency

SAS 112 – Type of Deficiencies

Control Deficiency “exists when the design or operation of a control

does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.”

Design deficiency Operation deficiency

SAS 112 – Type of Deficiencies

Significant Deficiency “a control deficiency or combination of deficiencies

that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP such that there is more than a remote likelihood that a misstatement of the f/s that is more than inconsequential will not be prevented or detected.”

SAS 112 – Type of Deficiencies

Significant Deficiency, cont’d More than remote likelihood –

Chance of an event occurring is more than slight but less than likely

Reasonably possible

More than inconsequential – “Prudent official, reasonable person” concept Quantitative and qualitative assessment Approximately 20% of tolerable misstatement

SAS 112 – Type of Deficiencies

Material Weakness A significant deficiency, or combination of significant

deficiencies, that results in more than a remote likelihood that a material misstatement of the f/s will not be prevented or detected.

SAS 112 – Previous Definitions

Material Weakness (SAS 60) A reportable condition in which the design or

operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements caused by error or fraud in amounts that would be material in relation to the financial statements being audited may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions.

SAS 112 vs. SAS 60

Material Weakness

Significant Deficiency

Control Deficiency

Material Weakness

Reportable Condition

Mgmt Letter Comment

SAS 112 SAS 60

Evaluating Control Deficiencies

Evaluation:Depends on the potential for misstatement

Management Acceptance:Conscious decisions on the part of

management to accept a degree of risk does not preclude auditor communication

Evaluating Control Deficiencies

Examples of significant deficiencies: Inadequate selection and application of GAAPLack of antifraud programs and controlsLack of controls over non-routine transactionsLack of controls over period end financial

reporting

Evaluating Control Deficiencies

Examples of material weaknesses:Restatement of previously issued financial

statements or prior-period adjustments Identification of a misstatement by the auditor

(not initially detected by I/C) Ineffective risk assessment function Ineffective compliance monitoringFailure to assess previous deficiencies

Auditor Reporting

Significant deficiencies and material weaknesses must be reported to “those charged with governance”

Communication is best made by the report release date but should be made no later than 60 days following the release date

Concluding Remarks

SAS 112 is not just an Auditor-Controller (A/C) issueGood internal control is a County-wide

responsibilityTimely coordination with departments and A/C

office is key

Questions?