SAS No. 112

1
SAS No. 112 114 Communicating Internal
Control Related Matters Required Communications
to Those Charged with Governance

• Presented by Auditor of State
• Fred Kruse, Chief Auditor AA Division

2
SAS No. 112

• In response to many questions from the field, we
  issued ADAM 2007-07
• We sent this ADAM to registered IPA firms
• In this session, we will reiterate the basic
  concepts
• We will also share some clarifications we now
  incorporate into our understanding of SAS 112

3
Old Versus New
4
Question 1  Does a control deficiency exist, and
is the likelihood of a misstatement resulting
from the deficiency more than remote? 

• Considerations  A control deficiency exists, and
  the likelihood of a misstatement is normally more
  than remote if any of the following occurs 
•  

5
Question 1  Does a control deficiency exist, and
is the likelihood of a misstatement resulting
from the deficiency more than remote? (cont.)

• We find one or more misstatements (regardless of
  amount). (A misstatement suggests one of the
  following exist.) We would deem the likelihood
  more than remote.
• If a necessary control is inadequately designed
  or nonexistent.
• A control is adequately designed, but the auditor
  finds one or more control operating failures,
  regardless of whether we find misstatements due
  to control failures.
• Also SAS 112 19 and the SAS 112 App describe
  other indicators of significant deficiencies or
  material weaknesses. For example, restatements
  to correct material misstatements from
  previously-audited statements are prima facie
  evidence of a material weakness.
• If based on the above Considerations, we
  determine a control deficiency exists and the
  likelihood of misstatement is more than remote,
  proceed to Question 2. 

6

Question 2 Is the amount of the misstatement
that occurred (or that could have occurred, if
related to a control failure) more than
inconsequential?

• Considerations 
• The amount is more than inconsequential (e.g.
  more than 20 of financial statement materiality)
  if any of the following occurs
• An actual or projected misstatement from a
  substantive procedure is more than 20 of overall
  financial statement materiality
• A nonexistent or inadequately-designed control
  could potentially lead to a misstatement of more
  than 20 of overall financial statement
  materiality.
• The potential misstatement is the entire
  transaction type or balance for which no control
  existed.

7
Question 2 Is the amount of the misstatement
that occurred (or that could have occurred, if
related to a control failure) more than
inconsequential?

• Considerations (cont.)
• A control operating failure rate (projected or
  otherwise) could potentially lead to a
  misstatement of more than 20 of overall
  financial statement materiality. 
• The potential misstatement would be the
  transaction type or balance subject to the
  control, multiplied by the projected control
  failure rate.
• A significant deficiency exists (subject to the
  qualitative and other judgmental considerations
  Part 2 describes). Proceed to Question 3

8
Question 3 Is a misstatement amount that
occurred (or what could have occurred, if related
to a control failure) material?

• Considerations 
• The significant deficiency is also a material
  weakness if any of the following occurs
• An actual or projected misstatement from a
  substantive procedure is material to a financial
  statement
• A nonexistent or inadequately-designed control
  could potentially lead to a material misstatement
• The potential misstatement is the entire
  transaction type or balance for which no control
  existed
• A control operating failure rate (projected or
  otherwise) could potentially lead to a material
  misstatement. 
• The potential misstatement would be the
  transaction type or balance subject to the
  control, multiplied by the projected control
  failure rate

9
Qualitative Considerations

• During the audit period, the fiscal officer posts
  a state-levied license tax to a property and
  other local taxes receipts code.
• Assume the amount is more than inconsequential,
  but less than material.
• Is this a significant deficiency?
• Maybe not because
• Total receipts are unaffected.
• The change in fund cash balance for the year is
  unaffected.
• Beginning and ending fund cash balances are
  unaffected.
• The misposting is not material noncompliance

10
Other Issues

• Are noncompliance findings significant
  deficiencies?
• Yes, if they meet the definition and threshold of
  a significant deficiency / material weakness
• But ----- See the following slides!

11
Noncompliance Example

• Is purchasing an unauthorized investment a SAS
  112 control deficiency?
• Assume the entity disclosed the investment type
  properly, including the GASB requirements to
  disclose authorized investments and
  finance-related noncompliance
• This is not a SAS 112 control deficiency because
  in this example, it did not create a misstatement

12
Noncompliance Example

• Is overspending appropriations a SAS 112 control
  deficiency? After all, budgets are a critical
  control
• Assume the budget presentation presented /
  disclosed the over expenditure
• This is not a SAS 112 control deficiency, because
  the violation did not contribute to a misstatement

13
Noncompliance Example

• What if an entity posts interest earnings to the
  wrong funds?
• Assume the entity presented the statements for
  audit with the misposting
• A control deficiency exists, because a
  misstatement occurred and controls either did not
  exist or failed to prevent it

14
Clarification Controls over Financial Reporting

• Regarding compilations The auditee need not
  possess the ability to perform or re-perform the
  compilation, but must have properly designed and
  effectively operating controls to prevent or
  detect misstatements in the compilation.
• Controls would include hiring qualified
  accountants to compile the statements
• Reviewing and discussing the accountants
  results, etc.
• Applying the Yellow Book safeguards is also a
  control
• It provides another review by a person presumably
  familiar with the entitys financial activities
• Because the compiler and internal reviewer have
  different areas of expertise, they both have
  important roles to play and we believe it is
  important that the compiler clearly inform the
  auditee of their role in the compilation
• Otherwise, auditee will likely assume they have
  transferred all responsibility to compiler.
• For example, auditee personnel may have knowledge
  of subsequent events they should share with
  compiler

15
Clarification What is a misstatement? Seems
obvious, but

• It is not a misstatement if it relates to an
  account for which a compiler has not completed
  their compilation work!
• Including their supervisory reviews
• It is (arguably) not a misstatement if it arises
  from estimates when the auditor has more recent
  info than the compiler had at the time they
  compiled
• Though AU 560.03 (subsequent events) requires
  using the most recent available info

16
Clarification

• We asked the AICPA
• To what statements / reports does SAS 112 apply?
• Their response
• SAS 112 applies to internal controls over
  financial reporting
• Therefore applies to all information in basic
  statements
• RSI, because GASB deems it necessary to
  supplement the statements
• Supplemental information
• Remember it often derives from the basic
  statements
• (Continued on next slide!)

17
Clarification

• Stat tables, per Cod 2800.102
• Statistical tables present comparative data for
  several periods of timeoften ten years or
  moreor contain data from sources other than the
  accounting records. Examples of such
  nonaccounting information are assessed valuations
  and tax rates, economic and population data, and
  the legal debt margin.
• Question Do you think SAS 112 applies to CAFR
  stat tables?

18
Clarification Testing Compensating Controls

• 14 of SAS 112 inferred auditors must test the
  operating effectiveness of compensating controls
  in order to avoid classifying the deficiency as
  significant or material
• But per paragraph 14 of the proposed SAS
• The auditor is not required to consider the
  effects of compensating controls for the purpose
  of communicating significant deficiencies or
  material weaknesses, however
• If the auditor decides to consider the effects of
  compensating controls to avoid reporting a
  control deficiency
• Evaluate the sufficiency of the design of the
  compensating controls, and
• Determine whether the compensating controls were
  implemented.

19
All this might not matter for long because a
draft SAS

• Would redefine significant deficiency ?
• As a control deficiency(ies) less severe than a
  material weakness, yet important enough to merit
  attention by those charged with governance!
• The intent of the new SAS is to align this
  definition with
• SSAE Internal Control Examinations . . .
• Public Company Accounting Oversight Board
  definition
• Proposed revision to international auditing
  standards

20
SAS 114The Auditors Communication With Those
Charged With Governance

• Effective for years beginning on or after
  December 15, 2006
• Replaces SAS 61, Communications to Audit
  Committees
• We have followed SAS 61 since 1988
• If governments had no audit committee, we deemed
  the governing body the de facto committee
• We discussed this in ADAM 2008-001
• We sent this to IPAs

21
Those Charged with Governance

• In the governmental environment, those charged
  with governance include the governing /
  legislative body.
• However, those charged with governance in many
  Ohio local governments lack oversight authority
  over financial reporting when the CFO is publicly
  elected.
• Nevertheless, we will communicate all SAS 114
  matters to the governing board
• Mayors, school superintendents, etc. are part of
  management for SAS 114 purposes.
• Those charged with governance also include
  community school sponsors.
• The permanent file should document who we deem to
  fall within this definition, to help assure we
  communicate the required information to them.

22
Required Communications

• The auditors responsibilities under Generally
  Accepted Auditing Standards
• Included in our engagement letters
• The planned scope and timing of the audit
• We communicate both the above before commencing
  fieldwork

23
Qualitative aspects of the entitys significant
accounting practices

• This has been an SEC / SAS 90 requirement for a
  number of years, but did not previously apply to
  government audits.
• We believe this is primarily aimed at principles
  related to controversial or emerging areas
• Changes in principles that may be designed to
  enhance reported earnings
• Maybe not much applicability to general purpose
  governments

24
Accounting Estimates Disclosures

• Consider discussing material, subjective
  estimates and the adequacy of info available to
  form them
• Such as landfill closure / postclosure
  liabilities
• BWC insurance claims
• We contract this audit to an IPA
• Other humongous, subjective estimates
• Disclosures of interest might be those
• Required by new principles
• Of some controversy, if any

25
Significant difficulties, if any, encountered
during the audit

• This requirement was also in SAS 61
• Would include delays in receiving required
  information
• An unnecessarily brief time management imposes to
  complete the audit
• Unavailable information

26
Uncorrected Misstatements

• SAS 61 as amended had a similar requirement
• We share a copy of our unadjusted differences
  with the auditee
• AOS also communicates material corrected
  misstatements to help those charged with
  governance in assessing the quality of the
  accounting function

27
Disagreements with Management

• SAS 61 as amended had a similar requirement
• Relates to disagreements regarding
• Accounting principles
• Methods of compiling estimates
• Disclosures
• Wording of our opinion
• Does not include matters resolved or based on
  incomplete information

28
Other Communications

• Copy of representation letter
• Representation letters are an ancient requirement
• Managements consultations with other accountants
• The concern is opinion shopping
• We do not believe this applies to routine
  requests to another accountant for assistance
• Other significant issues we discussed with
  management

29
Questions???

• Questions may be sent via email to
• Fred Kruse at frkuse_at_auditorstate.oh.us

30
(No Transcript)