Have you talked with your auditor lately?
If you haven’t, you should call them soon and ask about SAS 112, a recent change in auditing standards that will affect audits of nonprofits. Because the new standard was effective in December 2006 we are just beginning to see audit reports using the new standards. SAS 112 establishes new definitions and standards for Communicating Internal Control Related Matters Identified in an Audit. Auditors have always considered the quality and sufficiency of internal controls as a component of the audit. If weaknesses in internal controls are observed, the auditors submit a management letter to the board describing the weaknesses and recommending further attention to these controls. We often joke that the “Segregation of Duties” comment is printed on the letterhead of the audit firms since so many nonprofits receive management letters with this finding. We all understand that it is very difficult to properly segregate all financial duties with a small staff. The new auditing standard could greatly increase the number of internal control weaknesses identified and reported – and cause concern and strong responses by nonprofit boards. The new standards do three things: provide new definitions and terminology for internal control weaknesses; allow the auditors less discretion in identifying weaknesses as significant; and require that auditors apply more complex standards that consider combinations of weaknesses, quantitative and qualitative factors. This article from the AICPA includes links to the SAS 112 document for a thorough review. Enough of the technical – what does this mean for your nonprofits?
The likelihood that control deficiencies will be identified and reported is probably higher. The auditor simply has to consider a much wider range of factors and apply a new and higher standard.
According to accounting firm PricewaterhouseCoopers, “we believe that the new definitions will lower the bar such that more control deficiencies will be considered severe.”
Even for the management letters with the same findings as previous years, the new terminology may cause concern. The term “reportable condition” is replaced with “significant deficiency”. More nonprofits will receive reports of control deficiencies related to their capacity to apply generally accepted accounting principles to financial transactions and financial reports. Think about your internal year-end financial reports. Do you correctly report the following information according to GAAP accounting rules: receipt and release of temporarily restricted funds, in-kind contributions, accrued expenses, and depreciation? If you have relied on your auditors to provide audit adjustments for these items, you should be prepared for a possible finding of a control deficiency. What should you do?
- Talk to your auditor before they come to start fieldwork about SAS 112 and how they will communicate with you during the audit.
- Next, communicate these new standards to your treasurer, finance committee and board of directors. The last thing you want is a surprise when the audit report is presented.
- Last, and most important, do what you can to improve your internal controls and quality of financial accounting. This is the ultimate purpose of the audit standards, and the goal for your nonprofit as a steward of your donor and supporters’ funds.