What makes a control deficiency significant?

The Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) has issued guidance on communicating matters related to a government’s internal control over financial reporting identified in an audit of financial statements. This guidance is applicable whenever an auditor expresses or disclaims an opinion on financial statements. These standards require auditors to report any material weaknesses [1] or significant deficiencies [2] identified in conjunction with the financial statement audit.

This guidance indicates that it is not sufficient that the independent auditor determine that the financial statements under audit are, in fact, fairly presented in accordance with generally accepted accounting principles (GAAP). Generally accepted auditing standards (GAAS) also require that the financial statements be the product of a financial reporting system that offers reasonable assurance that management is able to produce financial statements that comply with GAAP.

Independent auditors often assist clients with the preparation of their financial statements. Such assistance poses no problem if it is provided merely as a matter of convenience (i.e., management could produce the financial statements, but chooses not to). However, such assistance will constitute either a significant deficiency or a material weakness if it is provided as a matter of necessity rather than of convenience (i.e., management does not have the skills needed to prepare GAAP financial statements).

If management does not possess the skills to prepare GAAP financial statements on its own, the government could always choose to engage the services of someone other than the independent auditor to provide the needed assistance. Because such contractors would work for management (unlike the independent auditors) they would qualify as part of the government’s financial reporting system, thus avoiding an automatic finding of a significant deficiency or material weakness. The guidance also makes it clear that material auditor-identified audit adjustments typically will require that a significant deficiency or material weakness be reported.

GFOA recommends that governments take into account the following considerations in crafting a strategy [3] for minimizing any potential negative effect resulting from the communication of internal control related matters identified in an audit.

• Be prepared to provide evidence that the government has a sound financial reporting system in place. GFOA recommends that a government establish and document [4] a system of financial reporting that is sufficient to provide reasonable assurance that management is able to prepare financial statements in conformity with GAAP. Appropriate criteria for evaluating the adequacy of a government’s financial reporting system can be found in Internal Control: Integrated Framework, published by the Council of Sponsoring Organizations of the Treadway Commission (COSO).[5] In particular, the financial reporting system should incorporate an anti-fraud program and controls, as well as ongoing internal audit/risk assessment activity commensurate with the size and complexity of the entity. Further, the financial reporting system should include a program to test controls, assess the results of testing, and take prompt corrective action as necessary.
• Minimize the likelihood of material audit adjustments. Every practical step should be taken to minimize the possibility of material auditor-initiated audit adjustments. A periodic process during the year to ensure the ongoing completeness and accuracy of data [6] can aid in identifying and preparing adjustments to limit the number and dollar amounts of adjustments that result from the auditor. Further, procedures at the end of the period can also help limit auditor-initiated adjustments.  For example, a government should carefully review its cutoff procedures and the method it uses to uncover unrecorded liabilities at the end of the fiscal period (items found by the auditor rather than by management could result in a significant deficiency or material weakness being reported).

Special care also should be taken to ensure the timely and effective implementation of new accounting standards.[7] Accordingly, ongoing training should be provided to ensure that appropriate staff remains current on the authoritative guidance as it evolves.[8] Every attempt should be made to ensure that such training is provided consistently even when the government experiences fiscal stress or tough economic times.

• Review any financial statement preparation assistance provided by the independent auditors. If management chooses to make use of the services of the independent auditors in helping to prepare the financial statements as a matter of convenience, it should carefully document that a staff member with the requisite skills has reviewed all of the work performed by the auditor (e.g., by completing the GFOA financial reporting checklist or by using some similar review tool). If management does not have the skills necessary to prepare GAAP financial statements and desires the assistance of its independent auditors to help it do so, but without exposing itself to the risk of an automatic significant deficiency or material weakness, it may wish to consider obtaining the services of a consultant or some other outside party (e.g., retiree volunteer) to review the auditor’s work on the government’s behalf. Further, the use of a consultant can provide other benefits. For example, consultants may perform work during the year or at year end that can help the government minimize adjustments as discussed above.

GFOA does not recommend that governments engage the services of a second accounting firm to assist in preparing its financial statements solely to avoid having a significant deficiency or material weakness reported. It is by no means assured that the benefits of engaging a second firm would outweigh the costs. Moreover, a significant deficiency or material weakness might still be reported as the result of some other weakness in the financial reporting system (e.g., auditor-discovered audit adjustment), which could defeat the purpose of hiring the second firm.

If management decides that the costs of remedying a significant deficiency or material weakness in its financial reporting system cannot be justified by the benefits to be obtained, it should take care to alert the governing body as early as possible to explain its conclusion. In that case, governments subject to a Single Audit should explore the possibility of obtaining a waiver pursuant to paragraph 530c of U.S. Office of Management and Budget Circular A-133, “Audits of States, Local Governments, and Non-Profit Organizations,” so as not to jeopardize the auditee’s “low risk” status.

Notes: 

1 A deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility (the likelihood of the event is either reasonably possible or probable as those terms are defined in the Financial Accounting Standards Board Accounting Standards Codification glossary) that a material misstatement of the government’s financial statements will not be prevented, or detected and corrected on a timely basis.

2 A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

3 While this strategy will help the government to avoid, limit, or eliminate findings related to its internal control over financial reporting, ultimately, it is the independent auditor’s responsibility to make the judgment about what findings to report.

4 See GFOA’'s Best Practice, Policies and Procedures Documentation, 2007.

5 The guidance offered in this report is discussed and applied specifically to local governments in the GFOA publication Evaluating Internal Controls: A Local Manager's Guide.

6 See GFOA's Best Practice, Timely Financial Reporting, 2008.

7 See GFOA's Best Practice, Timely Financial Reporting, 2008.

8 While governments are encouraged to document their considerations in determining whether the person responsible for the accounting and reporting function has the knowledge and skills to appropriately apply generally accepted accounting principles in that capacity,  ultimately, it is the responsibility of the independent auditor to make that judgment about the government’s management.

This best practice was previously titled Practical Steps to Avoid, Limit, of Eliminate Internal Control Deficiencies Identified in an Audit.

• Board approval date: Monday, October 31, 2011