In today’s post, I tell you how to understand and communicate material weaknesses and significant deficiencies. Show
How do you categorize a control weakness? Is the weakness a material weakness, a significant deficiency or something less? This seems to be the most significant struggle in addressing internal control issues. And if you’ve been in the business for any time at all, you know that management can take offense regarding control weakness communications. For instance, a CFO may believe that a material weakness reflects poorly upon him. After all, he controls the design of the accounting system. So, communicating control weaknesses can result in disagreements. Therefore, it’s even more important that these communications be correct. Before telling you how to distinguish material weaknesses from significant deficiencies, let’s review control weakness definitions. Definitions of Control WeaknessesA deficiency in internal control is defined as follows: A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or competence to perform the control effectively. Now let’s define (1) material weaknesses, (2) significant deficiencies, and (3) other deficiencies.
How to Categorize a Control WeaknessesNow that we have defined material weaknesses and significant deficiencies, we can discuss how to distinguish between the two. Material WeaknessFirst, ask these two questions:
If your answer to both questions is yes, then the client has a material weakness. (By the way, if you propose a material audit adjustment, it’s difficult to argue that there is no material weakness. As you write your control letter, examine your proposed audit entries.) Significant DeficiencyIf your answer to either of the questions is no, then ask the following: Is the weakness important enough to merit the attention of those charged with governance? In other words, are there board members who would see the weakness as important. If the answer is yes, then it is a significant deficiency. If no, then it is not a significant deficiency or a material weakness. How to Communicate Material Weaknesses and Significant DeficienciesThe following deficiencies must be communicated in writing to management and to those charged with governance:
The written communication (according to AU-C section 265) must include:
Next, I explain how to communicate other deficiencies (those that are less than a material weakness or a significant deficiency). How to Communicate Other DeficienciesOther deficiencies can be communicated in writing or orally and need only be communicated to management (and not to those charged with governance). The communication must be documented in the audit file. So if you communicate orally, then follow up with a memo to the file addressing who you spoke with, what you discussed, and the date of the discussion. Stand-alone management letters are often used to communicate other deficiencies. Since there is no authoritative guidance for management letters, you may word them as you wish. Alternatively, you can, if you like, include other deficiencies in your written communication of significant deficiencies or material weaknesses. A Key Word of WarningAlways provide a draft of any written communications to management before final issuance. It is much better to provide a draft and find out (before issuance) that it contains an error or a miscommunication. Then, corrections can be made. Additional InformationWriting your internal control letter is a part of the wrap-up process for audits. Click here for additional information concerning wrapping up an audit. Learn from my CPA Hall Talk newsletter!Get my free accounting and auditing digest with the latest content. What are internal control weaknesses?An internal control weakness is a failure in the implementation or effectiveness of your internal controls. Bad actors can take advantage of weak internal controls to evade even the strongest security measures.
Which of the following is most likely to be considered as internal control weakness?Which of the following is most likely to be considered a material weakness in internal control? Ineffective oversight of financial reporting by the audit committee.
Which is worse material weakness vs significant deficiency?2. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting, that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of the company's financial reporting.
Does a material weakness mean a qualified opinion?This situation is a control deficiency that may constitute a material weakness if extensive. In this case, the auditor renders an adverse opinion. Inadequate management assessment creates a scope limitation requiring a disclaimer, a qualified opinion on internal control, or withdrawal from the engagement.
|