Independent financial statement audits are designed to provide assurance that the amounts reported in them are reasonably stated. An integral part of the audit process is an assessment of the effectiveness of an organization’s system of internal control.  As a result, the independent auditor gains valuable insight on how the organization works – from top to bottom.  Of late, due to increased requirements for auditors to communicate with clients, some organizations now view the auditor’s conclusions regarding organizational effectiveness as part of a larger strategy to fuel innovation and drive growth throughout the entire financial and functional spheres of the company. Whether an audit is required by law, or to meet debt or investor requirements, or to promote organizational health, independent auditors are required to provide a letter to both governance and management communicating their findings.

After the Audit

When the audit of financial statements is complete, professional standards by the AICPA (American Institute of CPAs) require that auditors administer a Statements on Auditing Standards (SAS) No. 114 letter to communicate to those charged with governance a collection of findings discovered throughout the audit process. If deemed necessary by audit findings, they may also administer a SAS 115 letter, called the Report to Management, containing deficiencies found during the audit and recommendations for improvements to internal control.

The auditor’s letters can provide fresh perspective and valuable information. The letters may even offer creative solutions to streamline processes, manage economic or environmental pressures, identify or manage organizational risks, or overcome internal challenges. It is prudent for members of management and governance (i.e., board of directors, owners) to consider the auditor’s findings seriously before filing the letters away.

SAS 114 Letter: Communicating the Scope of a Financial Statement Audit

The purpose of the SAS 114 letter is to openly communicate and advise on matters related to the financial statement audit process and relay any issues found as they relate to the division of responsibilities between the independent auditor and management, management disagreements, audit adjustments, and accounting estimates used to prepare the financial statements, among others.

While this letter may seem like a poor performance review, it is not intended that way. These findings are designed to bring errors and opportunities for improvement to the attention of the governing board, as well as management, as a way to benchmark best practices and implement changes to improve the overall wellbeing of the organization.

SAS 115 Letter: Communicating Matters of Internal Control

Professional standards also require that auditors have a basic understanding of an organization’s internal controls to effectively perform a financial statement audit and to plan an audit walkthrough. An audit walkthrough assesses risk of material misstatement and evaluates transaction cycles, which entails starting at the beginning of a transaction, following it through the accounting system, and finally, posting it to the general ledger.

Through this walkthrough process, auditors may become aware of matters related to controls that signal deficiencies. If a serious deficiency is discovered, AICPA requires auditors to issue a SAS 115 letter to directly communicate in writing to management about significant deficiencies or material weaknesses found within the internal controls of an organization.

What are the Three Types of Control Deficiencies?

Auditors may observe three types of control deficiencies during an audit. Overall, a deficiency in internal control exists when a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

Depending on the severity of the findings, a significant deficiency(s) presents a more serious concern and merits attention by those charged with governance.

A material weakness is a more severe deficiency(s) in internal control, such as the possibility that a material misstatement of the entity’s financial statements will not be prevented or detected and corrected on a timely basis.

Depending on the magnitude of the deficiency, not all deficiencies need to be communicated in writing, nor do they need to be corrected so long as an organization provides a reasonable explanation for the decision, such as cost outweighing the benefit. However, irrespective of the explanation, significant deficiencies and material weaknesses that are not remedied will continue to appear in SAS 115 letters until the deficiency is fixed.

What Happens Next?

One certainty, things will change. Accordingly, it is imperative that operational and internal control issues are continuously analyzed, implemented, and corrected. Changes such as new accounting software, staffing turnovers, change in revenue streams, or departmental restructuring are opportunities to evaluate whether the existing internal control and operational structure is sufficient to meet the new environment. Adapting to changes requires continuous attention that sometimes becomes impossible when managing the day-to-day business challenges. The observations of the independent auditor are especially important as the rate of change increases.  Attention to operational effectiveness and internal control is good for the bottom line and helps organizations position themselves for long-term financial health and growth.

R&A specializes in high quality audits and provides technical excellence to our clients. Contact us if you have questions about SAS 114 and SAS 115 communication letters. We look forward to helping you and your organization.