When does a control deficiency exist? 1307
-
I have a general question regarding when a deficiency exists. If company management discovers a prior period error (prior year in this case), does this imply that there is a deficiency given that the error was not timely detected? For example, in 2005 company management identifies some type of missapplication of GAAP that should have been caught in 2004. The error would change 2004 for comparative purposes.
-
It depends on when you implemented the controls and what type of controls you implemented.
You mentioned about detection of mis-applicaiton of GAAP. Does it mean that you had IMPLEMENTED a detective control for identifying such mis-applications. Again ‘type of missapplication of GAAP that should have been caught in 2004’ shows the lack of any control in this respect.
A control deficiency exists only if a Control mechanism exists( and is documented, from a SOX angle). If there is no mechanism at all then where is question of deficiency, its complete LACK of control.
-
When auditors form an opinion on internal control over financial reporting, they evaluate all evidence including:
- The adequacy of the assessment performed by management.
- The results of the auditors’ evaluation of the design.
- Tests of operating effectiveness of controls.
- Negative results of substantive procedures performed during the financial statement audit.
- Any identified control deficiencies.
An unqualified audit opinion may be issued when no material weaknesses in internal control have been identified and when there have been no restrictions on the scope of the auditor’s work. One or more material weaknesses in internal control result in an adverse opinion. Scope limitations result in either a qualified opinion or a disclaimer of opinion.
Determining whether any deficiencies have been identified, and if so, the likelihood of misstatement and potential amount is the key to identifying the proper opinion to issue. If no deficiencies have been identified, and no scope limitations are involved, an unqualified opinion is appropriate.
If a deficiency has been identified, both the likelihood of misstatement and the amount must simultaneously be considered. Both a significant deficiency and a material weakness have more than a remote likelihood of resulting in a material potential misstatement. If the potential amount is more than inconsequential, but less than material, a significant deficiency is involved; if the potential amount is material, it is a material weakness.
Standard No. 2 provides several examples of deficiencies that are at least significant deficiencies, including lack of:
Controls over the selection and application of accounting principles that are in conformity with generally accepted accounting principles.
Antifraud programs and controls.
Controls over non-routine and non-systematic transactions.
Controls over the period-end financial reporting process.
The standard also suggests that the following are at least significant deficiencies and strong indicators of the existence of a material weakness in internal control over financial reporting:
Restatement of previously issued financial statements to reflect a correction.
Identification by the auditors of a material misstatement that was not initially identified by the company’s internal control.
Ineffective oversight of external reporting by the audit committee.
An ineffective internal audit function.
An inadequate regulatory compliance function in highly regulated industries.
Significant deficiencies previously communicated that have gone uncorrected for a reasonable period of time.
An ineffective control environment.
Hope this helps,
Milan