SAS No. 112 Superseded by New SAS No. 115
DEAR CENTER MEMBERS
GAQC members should be aware that the AICPA Auditing Standards Board (ASB) recently issued Statement on Auditing Standards (SAS) No. 115, Communicating Internal Control Related Matters Identified in an Audit, which supersedes SAS No. 112 of the same name. Among the changes made by the new SAS are revisions to the definitions of the terms material weakness and significant deficiency that had been previously been established in SAS No. 112. The purpose of this Alert is to help member firms understand why this change was made, what major changes are resulting from the new SAS, and the implications for your governmental audits. SAS No. 115 is effective for audits of financial statements for periods ending on or after December 15, 2009. Earlier implementation is permitted. However, as noted in the "Implications for Your Governmental Audits" section below, there are certain factors that auditors performing audits under Government Auditing Standards, Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Nonprofit Organizations (Circular A-133), and other federal regulations and audit guides should consider prior to deciding whether to early implement this new standard.
Why the Change?
After the issuance of SAS No. 112, the Public Company Accounting Oversight Board (PCAOB) issued Auditing Standard (AS) No. 5, An Audit of Internal Control That is Integrated with an Audit of Financial Statements, which introduced new definitions of the various kinds of deficiencies in internal control and updated guidance for evaluating such deficiencies in examinations of issuers internal control over financial reporting. Similarly, the ASB recently issued Statement on Standards for Attestation Engagements (SSAE) No. 15, An Examination of an Entity's Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements, which establishes standards and provides guidance to practitioners performing an examination of a nonissuer's internal control over financial reporting in the context of an integrated audit. SSAE No. 15 aligned the definitions of the various kinds of deficiencies in internal control and the related guidance for evaluating such deficiencies with the definitions and guidance in AS No. 5. Therefore, to eliminate differences within the AICPA's Audit and Attest Standards resulting from the recent issuance of SSAE No. 15, i t was necessary for the ASB to align the definitions and related guidance for evaluating deficiencies in internal control over financial reporting with the definitions and guidance in SSAE No. 15.
What are the Major Changes?
SAS No. 115 contains the following revised definitions of the terms material weakness and significant deficiency as they relate to internal control over financial reporting:
A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected on a timely basis. [Note that in SAS No. 115, a reasonable possibility exists when the likelihood of the event is either reasonably possible or probable as those terms are used in Financial Accounting Standards Board Statement No. 5, Accounting for Contingencies.]
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
Even though on their face the new definitions might appear to allow more flexibility in determining what to report as a significant deficiency, auditors should keep in mind that the new SAS states that the severity of a deficiency depends on (1) the magnitude of the potential misstatement resulting from the deficiency or deficiencies; and (2) whether there is a reasonable possibility that the entity's controls will fail to prevent, or detect and correct a misstatement of an account balance or disclosure. These criteria are very similar to the "magnitude" and "likelihood" criteria that were previously "built-in" to the significant deficiency definition.
The new SAS also revises the list of deficiencies in internal control that are indicators of material weaknesses to consist of the following:
- identification of fraud, whether or not material, on the part of senior management;
- restatement of previously issued financial statements to reflect the correction of a material misstatement due to error or fraud;
- identification by the auditor of a material misstatement of the financial statements under audit in circumstances that indicate that the misstatement would not have been detected by the entity's internal control; and
- ineffective oversight of the entity's financial reporting and internal control by those charged with governance.
Finally, SAS No. 115 no longer includes a list of deficiencies that ordinarily would be considered at least significant deficiencies and contains a revised illustrative written communication to management and those charged with governance of material weaknesses and significant deficiencies.
Implications for Your Governmental Audits
As occurred when SAS No. 112 was issued, there is likely to be a ripple effect to other governmental standard-setters and regulators as a result of the issuance of SAS No. 115. The Government Accountability Office (GAO) reported at a recent AICPA conference that with the issuance of SAS No. 115, it will now begin working to revise Government Auditing Standards, to be consistent with the new definitions established in SAS No. 115. Additionally, the GAQC staff will begin working with OMB and other federal agencies that require reporting on internal control over compliance to determine the changes needed to their regulations and/or federal audit guides as a result of SAS No. 115. The GAQC will keep you informed as to progress made in this area by GAO, OMB, and other federal agencies.
In the meantime, as noted in the introduction to this Alert, the new SAS does permit early implementation. However, neither the Government Auditing Standards, Circular A-133, nor other similar federal regulations nor audit guides have been updated to reflect the new internal control definitions. Therefore, it would not be appropriate for auditors to early implement SAS No. 115 for their audits performed under these standards and requirements (that is, their governmental audits). For this reason, firms whose practices include both governmental and non-governmental audits will want to think seriously about the implications and practicality of early implementing SAS No. 115 for their non-governmental audits in that it may be confusing for staff that perform audits in both areas to audit and report using differing deficiency definitions. However, nothing would preclude a firm from doing so.
Keep an eye out for future GAQC communications on this as additional developments occur.
# # # # #
AICPA Governmental Audit Quality Center
Back to top
As a member of the Center, your firm will receive periodic updates on important developments related to governmental audits, as well as the activities of the Center. To stay abreast of these and other relevant events, please visit the Center Web site at gaqc.aicpa.org. Also, we welcome any suggestions or questions. Please send them by e-mail to GAQC@aicpa.org.
Back to top
Members of the Governmental Audit Quality Center ( GAQC) may only reproduce and distribute GAQC e-alerts internally within a firm to other Center member firm personnel as part of the firm's professional services. For information about permission to copy any part of these documents for redistribution or inclusion in other work, please click on the copyright notice at the bottom of the page or phone the AICPA copyright permission hotline (919) 402-4031.
©2008 The American Institute of Certified Public Accountants,
AICPA Online privacy policies and copyright information.
AICPA, 1211 Avenue of the Americas, New York, NY10036
Back to top