By: Ariana Young, CPA, Audit Manager
It has been over 10 years since Sarbanes-Oxley rocked the world of accounting and set into motion a domino effect of increased scrutiny over internal controls and governance. One of the most notable changes was the requirement for public companies to document, evaluate, and test internal controls over financial reporting, which lead the AICPA to issue SAS 112, “Communicating Internal Control Related Matters Identified in an Audit,” and define the standards on reporting internal control deficiencies for all entities (public and nonpublic). SAS 112, which became effective for fiscal years ending after December 15, 2006, resulted in a revamped management letter being introduced with new and seemingly strange terminology such as material weakness and significant deficiency. Later iterations of the standard, such as SAS 115, further clarified and defined categories of control deficiencies that are now contained in AU Section 325. By defining and categorizing control deficiencies, the management letter has become even more like a report card for nonprofit organizations.
Correcting control deficiencies is critically important to the financial health of all nonprofit organizations because weaknesses can have the impact of allowing a material misstatement in financial reporting to go undetected or worse yet, they can be manipulated to allow someone to perpetrate fraud. When thinking about control deficiencies, the mindset should always be “what could go wrong?” rather than “what has gone wrong?” Now that we have lived with the new management letter for over 6 years, it seems like a good time to reflect on some of the most common control deficiencies identified in nonprofit audits and how to correct them.
1) Improper segregation of duties – Generally speaking, this control deficiency occurs when one person has too much authority over a transaction cycle. This deficiency is often identified in smaller organizations who have staffing constraints or in larger organizations when one person takes over a position temporarily when another goes on an extended leave of absence.
What could go wrong here: The problem with improper segregation of duties is that an error could go undetected, resulting in a material misstatement of the financial statements, or undetected fraudulent activity, such as misappropriation of assets (stealing), could occur. Basically, this problem boils down to the person being able to alter the books or steal from the organization and cover up their tracks so that no one would be the wiser.
How to fix it: Aim to have at least two persons involved in every transaction cycle: one to prepare the transaction and one to post it and review it. If possible, assign a third person to prepare the bank reconciliation. Try to avoid situations where the person who posts cash receipts or cash disbursements also reconciles the bank statement, as this could provide an opportunity to conceal fraud or errors. Finally, consider reviewing the organization’s accounting manual on an annual basis to ensure the processes documented demonstrate an adequate segregation of duties and that the processes reflect what is actually occurring.
2) Ineffective oversight of financial reporting – This control deficiency occurs when there is no one assigned to review account reconciliations or the person assigned is not reviewing the reconciliations on a consistent basis. Furthermore, the person reviewing the reconciliation should be of an appropriate level (i.e. a supervisor of the preparer) that they could identify errors without fear of communicating them. This deficiency is often identified during the audit when there is no evidence of management’s review occurring or there has been a material amount of audit adjustments.
What could go wrong here: Errors in a specific month’s account activity could go undetected and potentially snowball into material misstatements over the course of an entire year. Additionally, fraud could occur since the lax review process provides an opportunity for employees to exploit the weakness for personal gain.
How to fix it: Someone in management should be reviewing monthly account reconciliations and either signing off on the physical paper reconciliation or indicating their review in a monthly close checklist. This way, the organization can track which accounts were reconciled, who reviewed the reconciliations, and when the review occurred. For accounts with significant volume or dollar amounts of activity the need for timely review is all the more critical to the preparation of accurate and error-free financial statements.
3) New or unusual transactions – From time to time, an organization will have transactions that are new or infrequently occurring and it will not have accounted for those transactions properly, in accordance with generally accepted accounting principles. Examples of events that often cause difficulty in selecting the appropriate accounting treatment include new market tax credits, mergers and acquisitions, intangible assets, revenue recognition of new revenue streams, and alternative investments.
What could go wrong: Errors in recording the transactions could occur which may have a material effect on the financial statements due to a lack of in-house knowledge or experience with implementing the proper accounting treatment. Depending on the pervasiveness and materiality of the errors, a significant deficiency or material weakness in internal control could result.
How to fix it: Consult your auditor throughout the year, not just at audit time, to make them aware of any new or unusual events or transactions that are significant to your organization. If you consult early and often, it can prevent a lot of material adjustments and management letter comments later on. Your auditor can point you in the right direction for obtaining specific accounting guidance or refer you to a specialist if the event or transaction requires it.
If the revised auditing standards have taught us anything, it is that by opening up the lines of communication between staff and management through a periodic review of your organization’s accounting processes, you can help your organization avoid surprises at year end regarding management letter findings and audit adjustments. The strengthening of internal controls is a responsibility that no organization should take lightly.
Ariana Young, CPA, is a manager in Tate & Tryon’s audit and assurance services department and can be reached at email@example.com.