The American Institute of Certified Public Accountants (AICPA) has recently enacted a series of sweeping changes to generally accepted auditing standards. Statements on Auditing Standards (SAS) No. 104-111, which are collectively known as the Audit Risk Suite, have substantially changed the audit process, especially as it relates to engagement planning and the assessment of risk. In releasing the new standards, the AICPA indicated that it believes the Audit Risk Suite represents a significant strengthening of auditing standards that will improve the quality and effectiveness of audits. The changes became effective for Michigan school districts with audits of the fiscal year ended June 30, 2008.
Just a year earlier, another significant new auditing standard–SAS No. 112, Communicating Internal Control Related Matters Identified in an Audit, which was issued after the Audit Risk Suite, but became effective earlier—increased the responsibility of auditors to report on identified deficiencies in internal controls to “those charged with governance” (i.e., the school board). Auditors are now required to closely evaluate the design of key internal controls, and perform tests specifically to determine whether those controls have been placed in operation. Together, these new standards make it considerably more likely that internal control related matters may be identified and reported during the audit process.
What Districts Should Do About the New Standards
The most important step for districts to take is to reevaluate their existing internal controls with an eye toward “what could go wrong” and what controls are in place to prevent errors or fraud from occurring. If a district hasn’t yet thoroughly documented its internal controls, now is the time to do so. Since adjustments identified during an audit can now result in findings being reported, districts should review the adjustments from the prior year, and seek to limit the need for auditor-proposed adjustments in the current year. Districts that choose to outsource the preparation of their financial statements to their auditors should consider how to implement controls to carefully review and approve those statements. In all cases, early communication with the district’s auditors will be helpful.
As is the case with any new auditing standard, there will likely be some inconsistencies in practice in the first year or two, as auditors begin to implement the new guidance. However, over time, these new auditing standards should improve both the quality and usefulness of audits as control deficiencies are identified and management seeks cost effective ways to mitigate the risks of misstatement and enhance internal controls.
A Closer Look at Internal Controls
The new standards have increased the responsibility of auditors from simply “gaining an understanding of an entity’s internal controls” for the purpose of planning an audit to “understanding the entity and its environment, including internal controls” as a primary audit procedure. At first, that might sound like a relatively minor difference in wording–but in practice, it amounts to a dramatic shift in the level of scrutiny auditors are now required to place on internal controls and the environment in which they operate.
Broadly speaking, internal control is a process designed to provide district management and the board of education governing board reasonable assurance regarding the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with applicable laws and regulations. In an audit of financial statements, the auditor is not required to perform procedures specifically to identify deficiencies in internal control or to express an opinion on the effectiveness of the entity’s internal control. Still, an auditor may become aware of control deficiencies in the process of obtaining an understanding of the entity’s internal control, communicating with management or others, and performing audit procedures. When such matters are identified, auditors are required to report these deficiencies to management and the board.
Audit Opinions vs. Audit Findings
The objective of a financial statement audit is the expression of an opinion about whether the financial statements are free of material misstatements. Accordingly, the auditors’ opinion is focused on the final version of the financial statements, as reported in the audit—not the process followed to prepare and/or adjust those financial statements. By contrast, SAS No. 112 focuses on reporting matters related to the internal controls followed in the process of accounting for and reporting on an organization’s operations. Put another way, the audit opinion is an evaluation of the final product, while the matters reported in accordance with SAS No. 112 are an evaluation of the system of internal controls.
This distinction means that a school district could receive an unqualified (or “clean”) opinion on the financial statements, and still disclose one or more significant deficiencies or material weaknesses in internal control.
Compensating Controls
No system of internal control is perfect. An internal control system, no matter how well conceived and operated, can provide only reasonable–not absolute–assurance to management and the board regarding achievement of an entity’s objectives. In establishing appropriate internal controls, management must give careful consideration to the cost of a particular control and the related benefits to be received. Accordingly, management must make the difficult decision of what degree of risk it is willing to accept, given the district’s unique circumstances. Often when a particular control is not employed due to resource constraints, one or more other controls will take its place to lessen the risk of misstatement.
When evaluating control deficiencies, auditors are instructed to consider any compensating controls the district may have put in place. Compensating controls are used to limit the severity of a control deficiency and, in some cases, prevent it from rising to the level of a significant deficiency or material weakness. However, it is important to note that while compensating controls may mitigate the effects of a control deficiency, they do not eliminate the control deficiency.
In some cases, district management may already be aware of certain conditions determined by the auditor to be significant deficiencies or material weaknesses, and may have made the conscious decision to accept that degree of risk because of cost or other considerations. SAS No. 112 reminds auditors that the responsibility for weighing costs vs. benefits rests with management. However, the auditor’s responsibility to communicate these matters to the school district and board of education during each audit is unchanged by management’s decisions. Accordingly, certain control deficiencies (e.g., segregation of duties at a small entity) may be reported year after year.
Stephen Blann is a Principal of Government/Nonprofit Services with the Grand Rapids office of Rehmann Robson. He may be reached at stephen.blann@rehmann.com.