Internal Control Deficiencies in Audits

Accounting and Financial Reporting

Internal Control Deficiencies in Audits

Governments should craft an effective strategy for minimizing any potential negative effect resulting from the communication of internal control related matters identified in an audit.

The Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) has issued guidance on communicating matters related to a government’s internal control over financial reporting identified in an audit of financial statements. This guidance is applicable whenever an auditor expresses or disclaims an opinion on financial statements. These standards require auditors to report any material weaknesses or significant deficiencies[1] identified in conjunction with the financial statement audit.[2]

This guidance indicates that it is not sufficient that the independent auditor determine that the financial statements under audit are, in fact, fairly presented in accordance with generally accepted accounting principles (GAAP): generally accepted auditing standards (GAAS) also require that the financial statements be the product of a financial reporting system that offers reasonable assurance that management is able to produce financial statements that comply with GAAP.

Independent auditors often assist clients with the preparation of their financial statements. Such assistance does not constitute a significant deficiency or material weakness if it is provided merely as a matter of convenience (i.e., management could produce the financial statements, but chooses not to), although the auditor will have to consider how the provision of this service impacts their independence. However, such assistance will constitute either a significant deficiency or a material weakness if it is provided as a matter of necessity rather than of convenience (i.e., management does not have the skills needed to prepare GAAP financial statements).

If management does not possess the skills to prepare GAAP financial statements on its own, the government could always choose to engage the services of someone other than the independent auditor to provide the needed assistance. Because such contractors would work for management (unlike the independent auditors) they would qualify as part of the government’s financial reporting system, thus avoiding an automatic finding of a significant deficiency or material weakness. The guidance also makes it clear that material auditor-identified audit adjustments typically will require that a significant deficiency or material weakness be reported.

GFOA recommends that governments craft an effective strategy for minimizing any potential negative effects resulting from the communication of internal control related matters identified in an audit.

Be prepared to provide evidence that the government has a sound financial reporting system in place. GFOA recommends that a government establish and document[4] a system of financial reporting that is sufficient to provide reasonable assurance that management is able to prepare financial statements in conformity with GAAP. Appropriate criteria for evaluating the adequacy of a government’s financial reporting system can be found in Internal Control: Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).[5] In particular, the financial reporting system should incorporate an anti-fraud program and controls, as well as ongoing internal audit/risk assessment activity commensurate with the size and complexity of the entity. Further, the financial reporting system should include a program to test controls, assess the results of testing, and take prompt corrective action as necessary.

Be prepared to provide evidence that the government has a sound financial reporting system in place. GFOA recommends that a government establish and document[4] a system of financial reporting that is sufficient to provide reasonable assurance that management is able to prepare financial statements in conformity with GAAP. Appropriate criteria for evaluating the adequacy of a government’s financial reporting system can be found in Internal Control: Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).[5] In particular, the financial reporting system should incorporate an anti-fraud program and controls, as well as ongoing internal audit/risk assessment activity commensurate with the size and complexity of the entity. Further, the financial reporting system should include a program to test controls, assess the results of testing, and take prompt corrective action as necessary.

Minimize the likelihood of material audit adjustments. Every practical step should be taken to minimize the possibility of material auditor-initiated audit adjustments. A periodic process during the year to ensure the ongoing completeness and accuracy of data[6] can aid in identifying and preparing adjustments to limit the number and dollar amounts of adjustments that originate with the auditor. Further, procedures at the end of the period can also help limit auditor-initiated adjustments. For example, a government should carefully review its cutoff procedures and the method it uses to uncover unrecorded liabilities at the end of the fiscal period (since items found by the auditor rather than by management could result in a significant deficiency or material weakness being reported).

Special care also should be taken to ensure the timely and effective implementation of new accounting standards.[7] Accordingly, ongoing training should be provided to ensure that appropriate staff remains current on the authoritative guidance as it evolves.8 Every attempt should be made to ensure that such training is provided consistently even when the government experiences fiscal stress.

Review any financial statement preparation assistance provided by the independent auditors. If management chooses to make use of the services of the independent auditors in helping to prepare the financial statements as a matter of convenience, it should carefully document that a staff member with the requisite skills has reviewed all of the work performed by the auditor (e.g., by completing the GFOA financial reporting checklist or by using some similar review tool). If management does not have the skills necessary to prepare GAAP financial statements and desires the assistance of its independent auditors to help it do so, but without exposing itself to the risk of an automatic significant deficiency or material weakness, it may wish to consider obtaining the services of a consultant or some other outside party (e.g., retiree volunteer) to review the auditor’s work on the government’s behalf. Further, the use of a consultant can provide other benefits, for example, consultants may perform work during the year or at year end that can help the government minimize adjustments as discussed above.

GFOA does not recommend that governments engage the services of a second accounting firm to assist in preparing its financial statements solely to avoid having a significant deficiency or material weakness reported. It is by no means assured that the benefits of engaging a second firm would outweigh the costs. Moreover, a significant deficiency or material weakness might still be reported as the result of some other weakness in the financial reporting system (e.g., auditor-discovered audit adjustment), which could defeat the purpose of hiring the second firm.

If management decides that the costs of remedying a significant deficiency or material weakness in its financial reporting system cannot be justified by the benefits to be obtained, it should document that conclusion and take care to alert the governing body as early as possible to explain its conclusion.

Notes: 

  1. A material weakness is defined as “a deficiency (or combination of deficiencies) in internal control, such that there is reasonable possibility that a material misstatement of an entity’s financial statements could occur that would not be prevented, or detected and corrected on a timely basis.” 
    A significant deficiency is defined as a “deficiency or combination of deficiencies, in internal control that is “less severe than a material weakness, yet important enough to merit attention by those charged with governance.” ” 
    A deficiency “exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.” (American Institute of Certified Public Accountants, Professional Standards, U.S. Auditing Standards (2021), "Communicating Internal Control Related Matters Identified in an Audit," paragraph 265.07).
  2. American Institute of Certified Public Accountants, Professional Standards, U.S. Auditing Standards (2021), "Communicating Internal Control Related Matters Identified in an Audit," paragraphs 265.11- 265.12.
  3. While this strategy will help the government to avoid, limit, or eliminate findings related to its internal control over financial reporting, ultimately, it is the independent auditor’s responsibility to make the judgment about what findings to report.
  4. See GFOA’'s Best Practice, Policies and Procedures Documentation, 2021.
  5. The guidance offered in this report is discussed and applied specifically to local governments in the GFOA publication Evaluating Internal Controls: A Local Manager's Guide. An additional source of information about COSO directly applicable to governments is Standards for Internal Control in the Federal Government, commonly referred to as “The Green Book.”
  6. See GFOA's Best Practice, Timely Financial Reporting, 2020.
  7. Ibid.
  8. While governments are encouraged to document their considerations in determining whether the person responsible for the accounting and reporting function has the knowledge and skills to appropriately apply generally accepted accounting principles in that capacity, ultimately, it is the responsibility of the independent auditor to make that judgment about the government’s management.

This best practice was previously titled Practical Steps to Avoid, Limit, of Eliminate Internal Control Deficiencies Identified in an Audit.

Committees: Accounting, Auditing, and Financial Reporting (AAFRC)

Board approval date: Thursday, September 1, 2022

Internal Control Best Practice Suite

Share now!