In an effort to help practitioners better understand and implement the requirements of Statement on Auditing Standards (SAS) No. 112, Communicating Internal Control Related Matters Identified in an Audit, the AICPA staff has developed an Audit Risk Alert entitled Understanding SAS No. 112 and Evaluating Control Deficiencies: A Companion to SAS No. 112, Communicating Internal Control Related Matters Identified in an Audit. This Audit Risk Alert summarizes the important aspects of the new standard and presents a number of short case studies designed to guide the auditor though the process of evaluating identified control deficiencies. To obtain this new risk alert go to: https://www.cpa2biz.com/stores/sas112.

During this summer and fall, the Audit & Attest Team has become aware that some practitioners may be misunderstanding certain concepts that are important to SAS No. 112. The most common misunderstanding is the belief that the auditor’s drafting of the client’s financial statements automatically results in a material weakness.  Asking the auditor to draft the financial statements does not cause a control deficiency; however, it may be the result of a control deficiency. A control deficiency exists if the client does not have controls over the preparation of the financial statements, including the footnote disclosures, which would prevent or detect a misstatement in the financial statements. This misunderstanding and others are debunked in the Audit Risk Alert.

The following are some key underlying concepts that will help in successfully implementing SAS No. 112:

·         The auditor cannot be part of a client’s internal control.  Becoming part of a client’s internal control impairs the auditor’s independence.

·         What the auditor does is independent of the client’s internal control over financial reporting. Therefore, the auditor cannot be a compensating control for the client.

·         The client’s designation of an individual who possesses suitable skill, knowledge, and/or experience to oversee a service performed by the CPA (Ethics Interpretation 101-3 Performance of Nonattest Services) is not a control. Therefore, having such a designated person does not mean that the client does not have a control deficiency. 

·         SAS No. 112 does not require the auditor to search for control deficiencies, but rather to evaluate them if they have been identified.

·         A system of internal control over financial reporting does not stop at the general ledger; rather it includes controls over the preparation of the financial statements. 

·         To properly apply SAS No. 112 the auditor has to have a working knowledge of the COSO framework.  COSO’s Internal Control-Integrated Framework describes the elements of internal control over financial reporting. SAS No. 112 directs the auditor to evaluate control deficiencies when identified, and communicate certain deficiencies to management and those charged with governance.

Keeping these simple but important underlying concepts in mind will help auditors successfully implement the new Standard.