The Auditing Standards Board has issued Statement on Auditing Standards (SAS) No. 115, Communicating Internal Control Related Matters Identified in an Audit. SAS No. 115 conforms the definitions of the various kinds of deficiencies in internal control and the related guidance for evaluating such deficiencies in AU Section 325, Communicating Internal Control Related Matters Identified in an Audit, with the definitions and guidance in Statement on Standards for Attestation Engagements (SSAE) No. 15 (AT 501), An Examination of an Entity’s Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements. SSAE No. 15 aligned the definitions of the various kinds of deficiencies in internal control and the related guidance for evaluating such deficiencies with the definitions and guidance in Public Company Accounting Oversight Board Auditing Standard No. 5, An Audit of Internal Control That is Integrated with an Audit of Financial Statements. SAS No. 115 provides the following definitions:
- A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis.
- A deficiency in design exists when (a) a control necessary to meet the control objective is missing; or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.
- A deficiency in operation exists when (a) a properly designed control does not operate as designed; or (b) the person performing the control does not possess the necessary authority or competence to perform the control effectively.
- A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.
- A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
SAS No. 115 revises the list of deficiencies in internal control that are indicators of material weaknesses, and no longer includes a list of deficiencies that ordinarily would be considered at least significant deficiencies. The Statement contains a revised illustrative written communication of material weaknesses and significant deficiencies to management and those charged with governance. SAS No. 115 supersedes SAS No. 112 of the same title.
SAS No. 115 is effective for audits of financial statements for periods ending on or after December 15, 2009. Earlier implementation is permitted. |
