Proposed Statement on Auditing Standards, Communicating Internal Control Related Matters Identified in an Audit

This proposed Statement on Auditing Standards (SAS) is being issued to conform the definitions in AU section 325, Communicating Internal Control Related Matters Identified in an Audit (AICPA, Professional Standards, vol. 1), of the various kinds of deficiencies in internal control and the related guidance for evaluating such deficiencies with the definitions and guidance in the proposed Statement on Standards for Attestation Engagements (SSAE), An Examination of an Entity’s Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements.That proposed SSAE is being exposed for comment concurrently with this exposure draft. In addition to eliminating differences within the AICPA’s Audit and Attest Standards, the amendment also would align these definitions with those used by the Public Company Accounting Oversight Board and the definitions in an exposure draft of a proposed International Standard on Auditing 265, Communicating Deficiencies in Internal Control, currently being exposed for comment by the International Auditing and Assurance Standards Board.

Requests for Comments on Specific Topics

Although the exposure process is intended to solicit comments or suggestions on any aspect of this proposed SAS, the ASB would appreciate comments on the following matters.

Definition of Significant Deficiency

The definition of the term significant deficiency in extant AU section 325 includes “the likelihood and magnitude of the misstatement that could occur” as criteria for evaluating the severity of a control deficiency. The definition of that term in paragraph 7 of the proposed SAS no longer includes these criteria. The ASB believes that removing these criteria from the definition of significant deficiency will encourage auditors to consider qualitative factors and exercise greater professional judgment in determining what is and is not a significant deficiency, thus enabling auditors to inform management and those charged with governance about matters that better approximate their concerns about internal control. It is not the ASB’s intention to “lower the bar” in terms of what is a significant deficiency, as paragraph 8 makes it clear that the auditor still needs to evaluate magnitude and likelihood when evaluating the severity of any identified deficiency in internal control.

Question 1. Are these changes helpful in evaluating significant deficiencies? If not, how should the definition be amended?

Compensating Controls

Paragraph .54 of AU section 314, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (AICPA, Professional Standards, vol. 1), states that obtaining an understanding of internal control involves evaluating the design of a control and determining whether it has been implemented. Extant AU section 325, however, allows the auditor to consider the effectiveness of a compensating control as a basis for determining whether it mitigates the severity of a control deficiency only if the auditor has tested the operating effectiveness of the compensating control, even if the deficiency was identified while evaluating the design of the entity’s controls and determining whether they were implemented.

The ASB has concluded that the requirement to test the operating effectiveness of compensating controls in order to categorize a control deficiency for the purpose of communicating to management and those charged with governance goes beyond the auditor’s obligation to obtain an understanding of the entity and its environment, including its internal control. Paragraph 14 of the proposed SAS reflects this view and indicates that (1) the auditor is not required to consider the effects of compensating controls for the purpose of communicating significant deficiencies or material weaknesses, and (2) if the auditor decides to consider the effects of compensating controls for this purpose he or she should

evaluate the design of the compensating controls to determine whether such controls are capable of preventing the deficiency from rising to the level of a significant deficiency or a material weakness, and
determine whether the compensating controls were implemented.

The ASB concluded that the proposed SAS need not provide guidance to the auditor whose strategy entails testing the operating effectiveness of controls because AU section 318, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (AICPA, Professional Standards, vol. 1), is very clear that an auditor may not rely on a control nor reduce control risk without testing controls.

Question 2. If the auditor identifies an improperly designed control, and is not testing the operating effectiveness of controls as part of the financial statement audit, is it sufficient for the auditor to evaluate the design of a compensating control, determine whether it has been implemented, and use that information as a basis for (1) considering the mitigating effects of the compensating control on the deficiency and (2) categorizing the deficiency for the purpose of communicating to management and those charged with governance?

How the Proposed SAS Affects Existing Standards

This proposed SAS would amend AU section 325.

The document is available below to download as a PDF file. The Adobe Acrobat Reader is needed to view a file in PDF format. The Reader is available as a free download from the Adobe Web site at www.adobe.com/prodindex/acrobat/readstep.html.

To begin downloading, click on the item below with the right-hand mouse button. Choose the "Save Target As" option if using a Microsoft browser. (If using a Netscape browser, choose "Save Link As.") Then, save the file to the appropriate location.

Download the Exposure Draft