international auditing and assurance standards board communicating deficiencies in internal control...
TRANSCRIPT
International Auditing and Assurance Standards Board
Communicating Deficiencies in Internal Control to Those Charged with Governance and Management
ISA Implementation Support Module
Prepared by IAASB Staff
October 2009
• Introduction
• New Terms and Definitions
• Communicating Significant Deficiencies
• Determining Significance of a Deficiency
• Communication of Deficiencies to Management
Overview
2
• The context for developing the standard
• All requirements and guidance relating to communication of material weaknesses in the old standards now in one place
• New standard provides enhanced guidance on
– Judging when an identified deficiency in internal control is significant
– Communicating significant deficiencies to TCWG
Introduction
Introduction
3
• Term “material weakness” no longer used in the ISAs
• Standard introduces two new terms– A deficiency in internal control
– A significant deficiency
• No longer a requirement to communicate material weaknesses in the ISAs, but a requirement to communicate significant deficiencies
New Terms and Definitions
New Terms and Definitions
4
• This exists when– A control is designed, implemented, or operated
in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis, or
– A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing
Deficiency in Internal Control
New Terms and Definitions
5
• Defined as
– A deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance
Significant Deficiency
New Terms and Definitions
6
• IAASB does not intend that further work be performed beyond practice of communicating material weaknesses under old standards
• Significant deficiency regarded as being at the same level of significance as material weakness under old standards
• No expectation that new standard should result in reporting of more matters than would have been the case with material weaknesses under old standards
Implications of New Terms and Definitions
New Terms and Definitions
7
• Communicate significant deficiencies in writing to TCWG on timely basis
• Also communicate significant deficiencies in writing to management on timely basis, unless inappropriate to do so in the circumstances
• Requirement to communicate applies regardless of cost or other considerations by TCWG or management in determining whether to take remedial action
• Requirement also applies if significant deficiencies have been communicated in prior audit but no remedial action has been taken
Communicating Significant Deficiencies
Communicating Significant Deficiencies
8
• A description of the significant deficiencies
• An explanation of their potential effects
• Sufficient information to enable TCWG to understand context of communication
– Purpose of audit
– Audit does not include expression of opinion on effectiveness of internal control
– Significant deficiencies reported limited to those identified during the audit
Content of written communication
Communicating Significant Deficiencies
9
• Some jurisdictions may have a legal or regulatory requirement for auditor to communicate material weaknesses to TCWG– Standard does not directly address such a
requirement
• However, if “material weakness” has not been defined in law or regulation, standard provides guidance to explain how interpretation of such a requirement might be made in context of the standard
Communication of Material Weaknesses in Law or Regulation
Communicating Significant Deficiencies
10
• A matter of the auditor’s professional judgment– Based on what auditor believes is of sufficient
importance to merit attention by TCWG
• Judgment needs to be made having regard to roles and responsibilities of TCWG, informed by auditor’s understanding of the entity and its environment, including its internal control
Determining Significance of a Deficiency
Determining Significance of a Deficiency
11
• Auditor’s determination necessarily a subjective exercise because it rests on professional judgment
• However, standard provides new guidance to assist auditor in making that judgment
• In particular, the significance of a deficiency depends on two factors
– The likelihood that a misstatement could occur
– The potential magnitude of the misstatement
Guidance in Determining Significance
Determining Significance of a Deficiency
12
• Standard also provides guidance on– Relevant considerations, e.g.,
Susceptibility to loss or fraud of the related asset or liability
Subjectivity and complexity of determining accounting estimates
Financial statement amounts exposed to the deficiencies
– Indicators of the existence of significant deficiencies, e.g., Evidence of ineffective aspects of the control
environment
Guidance in Determining Significance
Determining Significance of a Deficiency
13
• Governance structures will be simpler and less formal in SMEs relative to larger entities
• Therefore, less of a need for formality in the communication of significant deficiencies in SME context
• However, communication of significant deficiencies will need to be in writing
SME Considerations
Determining Significance of a Deficiency
14
• Communicate identified deficiencies other than significant deficiencies to management if auditor believes that they merit management’s attention
– These other deficiencies may be of importance to management in effectively discharging their internal control responsibilities
• Use of professional judgment essential in making this determination
– No elaborate evaluation or communication process intended
Communication of Deficiencies to Management
Communication of Deficiencies to Management
15
• However, no requirement to re-communicate other deficiencies previously communicated to management by– The auditor– Other parties
• Also no requirement to communicate other deficiencies to management in writing– In most cases, this communication will take place
when auditor discusses relevant facts and circumstances of the matter with management
Communication of Deficiencies to Management
Communication of Deficiencies to Management
16
Note
This set of support slides does not amend or override the ISAs, the texts of which alone are authoritative. Reading the slides is not a substitute for reading the ISAs. The slides are not meant to be exhaustive and reference to the ISAs themselves should always be made. In conducting an audit in accordance with ISAs, the auditor is required to comply with all the ISAs that are relevant to the engagement.
17
Copyright © October 2009 by the International Federation of Accountants (IFAC). All rights reserved. Permission is granted to make copies of this work provided that such copies are for use in academic classrooms or for personal use and are not sold or disseminated and provided that each copy bears the following credit line: “Copyright © October 2009 by the International Federation of Accountants (IFAC). All rights reserved. Used with permission of IFAC. Contact [email protected] for permission to reproduce, store, or transmit this work.” Otherwise, written permission from IFAC is required to reproduce, store, or transmit, or to make other similar uses of, this work, except as permitted by law. Contact [email protected].
International Federationof Accountants
ISBN: 978-1-60815-044-1
www.ifac.org