Financial Audits – Deficiencies & Material Weaknesses & Their Meaning

A financial statement audit is designed to express an opinion on the financial statements, not on the entity's internal controls. However, obtaining an understanding of these controls remains a key part of every financial statement audit. Phil Philips, CPA of Watkins Meegan helps explain the language surrounding control gaps and deficiencies.

Files

Deficiencies & Material Weaknesses – What Do They All Mean?

A financial statement audit is designed to express an opinion on the financial statements. As part of obtaining that understanding, auditors may identify control gaps or deficiencies. If these deficiencies are significant, the auditor is obligated to report them to company management. 

Auditors have always been required to communicate control matters to management, so they would either submit a letter to management or review those matters in person with management. However, requirements were set in 2008 that those issues needed to be reported in writing and that auditors needed to report all control deficiencies they identify, not just the significant deficiencies as was previously required. 

These requirements could result in one or more of the following developments: 

Changes to the Definition of “Significant”

Under previous standards, determining whether a control deficiency was “significant” was entirely a matter of professional judgment. In exercising that judgment, auditors often considered the specific circumstances of the entity - for example, its size or the complexity of its operations. The new standards define significant deficiencies as those that create more than a remote likelihood that a misstatement of the financial statements that is more than inconsequential will not be prevented or detected.

If the key thresholds of there being a remote likelihood of an error that is more than inconsequential seem low, they are. When these definitions became effective for public companies under the Sarbanes-Oxley Act, most auditors determined to establish thresholds for reporting that were much lower than what they had used in the past. As a result, it is likely that control deficiencies that were not considered “significant” in the past will now meet the definition, triggering written communication from the auditor.

Reporting Deficiencies From Prior Audits

Under the old standards, the auditor was not required to report deficiencies that the audit committee (or its equivalent) already knew about. No such exception exists under the current standards - your auditor is required to report all significant deficiencies that exist, even those that have existed for some time and that management knows exist.

De Facto Significant Deficiencies

Previous standards allowed the auditor to use extensive judgment in determining whether to include an identified control deficiency in a letter to management. In contrast, the new standards list a dozen different conditions that are de facto significant deficiencies and therefore are required to be reported. It is possible that these conditions existed at your organization for some time but were not reported because, in the auditor's judgment, they were not considered significant. Now the auditor has no choice. 

Increased Emphasis on Internal Control

The audit of the financial statements does not require the auditor to identify all control deficiencies that may exist at an entity. New auditing standards require auditors to perform substantially more work to understand internal controls than was required in the past. As a result of this additional work, it is possible that the auditor will identify more control deficiencies. Conditions that existed in the past but that went unnoticed now may come to light.

These guidelines have been provided by Watkins Meegan, a TBS CPA Partner.

Watkins Meegan
7700 Wisconsin Avenue
Suite 500
Bethesda MD, 20814

Ph: 301.654.7555
Fax: 301.656.9115