Loading...
HomeMy WebLinkAboutAgenda - 10-18-2007-1ORANGE COUNTY BOARD OF COMMISSIONERS ACTION AGENDA ITEM ABSTRACT Meeting Date: October 18, 2007 Action Agenda Item No. ~_ SUBJECT: Potential Impact of Statement of Auditing Standards (SAS) 112 DEPARTMENT: Finance PUBLIC HEARING: (Y/N) No ATTACHMENT(S): Letter from Sharon Edmundson, Director of Fiscal Management Local Government Commission INFORMATION CONTACT: Ken Chavious, 245-2450 PURPOSE: To receive a presentation from McGladrey and Pullen, the County's current audit firm, on the potential impacts of the implementation of SAS 112. BACKGROUND: During the presentation of the 2006 Comprehensive Annual Financial Report last December, the auditors briefly mentioned some upcoming changes to the auditing standards. The Local Government Commission (LGC) has since addressed some of the major audit changes in a recent memorandum. The changes with most impact on the annual audit process are related to SAS 112. The attached memorandum from Sharon Edmundson, Director of Fiscal Management for the LGC, addresses in detail some of the issues surrounding the implementation of SAS 112. Representatives from the County's current audit firm, McGladrey and Pullen, will provide a brief presentation of the new auditing standards that will include the major changes to the audit process. Since the County's audit for the 2007 fiscal year is currently underway and not yet complete, the auditor's presentation will focus only on the guidelines of the new auditing standards. The County's Comprehensive Annual Financial Report will be presented at a later date, and the SAS 112 impacts therein will be discussed at that time. FINANCIAL IMPACT: None at this time. RECOMMENDATION(S): The Manager recommends that the Board receive the presentation as information. °~~"~°~. State of North Carolina ~~~ .~::~~.~ Department of State Treasurer State and Local Government Finance Division TREASURER and the Local Government Commission DEPUTY TREASURER August 1, 2007 TO: Local Government Board of Directors and Management FROM: Sharon Edmondson, Director Fiscal Management Section Memorandum #1077 SUBJECT: Statement on Auditing Standards No. 112, Communicating Internal Control Related Matters Identified in an Audit, from the Local Governments' Perspective. Summary Beginning with the 2006-2007 fiscal year, auditors, including those that audit local governments, are required to follow a new standard for reporting their findings that relate to the internal control structure of the entity being audited. In order to conduct their audits in accordance with generally accepted auditing standards, all auditors must implement this standard. SAS 112 will change the way the auditor reports any fmdings that he or she may have regarding the internal control structure in a unit of government. As a result, units of government in North Carolina may have more fmdings cited in their audits than in previous years, despite the fact that those units have not changed their methods of operations. The way those findings are reported also has changed. In previous reports, auditors noted findings as being "reportable conditions" while more serious issues were noted as "material weaknesses". SAS 112 expands the scope of what is reported as well as changes the terminology. Findings of control deficiencies will now be called either "significant deficiencies" or "material weaknesses". The definitions for all of these terms can be found in Appendix A of this memorandum. One of the most common concerns that a unit of government may have, particularly a unit with limited fmance staff, relates to fmdings as a result of the unit's auditor preparing the fmancial statements. SAS 112 does not require an auditor to make a fmding simply because the auditor prepares the fmancial statements for the unit of government. However, it is the belief of the LGC staff that many units of government that do not prepare their own financial statements will have a significant deficiency or material weakness reported. This will most likely be a result of the unit of government's limited staff and expertise in preparing financial statements in accordance with generally accepted accounting principles. Finally, the implementation of SAS 112 may cause both the auditor and the unit staff to spend additional time on the audit, particularly this first year. Fees may be increased due to this implementation. The following is a more detailed, technical discussion of the changes brought about by SAS 112. 325 North Salisbury Street, Raleigh, North Carolina 27603-1385 Telephone: (919) 807-2350 Fax: (919) 807-2352 Website: www.nctreasurer.com An Equal Opportunity/Affirmative Action Employer Memorandum No. 1077 August 1, 2007 Page 2 of 7 Discussion Last year, the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) issued the Statement on Auditing Standards (SAS) No. 112 Communicating Internal Control Related Matters Identified in an Audit. This statement establishes standards and provides guidance on the auditor's responsibilities for identifying, evaluating, and communicating matters related to an entity's internal control over financial reporting identified in the audit of the financial statements. The new standard replaces SAS No. 60, Communication of Internal Control Related Matters Noted in an Audit. SAS No. 112 is effective for audits of financial statements for periods ended on or after December 15, 2006, which is for fiscal year ended June 30, 2007 for most local governments and public authorities in North Carolina. Under this new Statement, auditors are required, as part of each audit, to report in writing all control deficiencies identified during the audit that are considered significant deficiencies or material weaknesses (see Appendix A for definitions) to management and those in charge of governance. Please note that the term `reportable condition', which was used in prior years' audits, will no longer be used. It has been replaced with `significant deficiency,' which covers a wider range of findings than `reportable condition' covered. The scope of what is deemed to be a `material weakness' also has been expanded. In addition, any significant deficiencies and material weaknesses that were communicated to management and the governing board in previous audits that have yet to be eliminated must continue to be communicated in writing to those charged with governance. Based on this increased scope, the LGC is expecting an increase in findings on internal controls and an increase in the written communications from auditors to North Carolina governments (e.g., letters may be issued to governments this year that did not receive management letters in the previous years). The auditor will evaluate control deficiencies identified during the course of the audit. The auditor's awareness of control deficiencies will vary with each audit and will be influenced by the nature, timing, and extent of audit procedures performed, as well as other factors. The significance of a control deficiency will depend on whether there is potential for a misstatement in financial reporting, not on whether a misstatement actually occurred. In addition, the auditor will consider both qualitative and quantitative factors. If the auditor determines that a control deficiency is not significant or material, it may still be communicated to the unit in writing. We believe that SAS No. 112 will improve the qualify of communications between the auditor, the governing board, and management. Most experts in this field agree that the new standard will result in more control deficiencies being reported as significant deficiencies or material weaknesses. In turn, the auditors may need to gather more information to make the SAS No. 112 determinations. Based on this and other factors, the LGC believes that SAS No. 112 may increase the audit engagement fees because of these new requirements. The LGC staff expects that auditors of smaller units of governments may issue a SAS No. 112 report that includes deficiencies in the areas of lack of segregation of duties and, perhaps, the lack of expertise in financial accounting and reporting. Our office is aware that the existence of these deficiencies and others may already be known to management, may have existed for some time, and may represent a conscious decision by management or the board to accept that degree of risk due to the cost of mitigating the deficiency or other considerations. Management and the board should Memorandum No. 1077 C..~ August 1, 2007 Page 3 of 7 understand that the auditor is presenting these findings concerning internal controls and is communicating them in writing as required by SAS No. 112. Management has a responsibility to respond to the findings but should understand that they are not a mandate to eliminate them at any cost. The LGC is encouraging independent auditors and the finance staff to educate the governing board and management of their governments to eliminate surprises at future board meetings if significant deficiencies or material weaknesses are presented as part of their annual audit. Units of government should understand that the auditor must be independent of their client's internal control. The auditor cannot be part of the client's internal control process over financial reporting by providing a compensating control (e.g., the government relies on the auditor to catch misstatements versus having in-house controls). Becoming part of the client's internal control impairs the auditor's independence. Therefore units of government, especially smaller governments, should evaluate the cost/benefit implications of improving their internal control, including training their personnel to be more knowledgeable. Appendix B lists several common control deficiencies to consider in the costlbenefit evaluation. The LGC also urges the auditors and their governmental clients to work together so that the audit can be submitted timely. At this time, the LGC does not plan to extend deadlines as a result of SAS No. 112. Common Concerns of SAS No. 112 This section provides discussion of common concerns as part of frequently asked questions to the AICPA in reference to SAS No. 112. Auditor prepared financial statements: For smaller units of governments or public authorities, auditors are questioning whether their preparation of draft fmancial statements should be considered a material weakness or at the very least a significant deficiency. The LGC's understanding is that the auditor can be contracted to assist management with the preparation and drafting of financial statements and related notes to the fmancial statement and not have either a significant deficiency or material weakness if in the professional 1udgment of the auditor the unit of government has adequate controls in place to take responsibility for the financial statements (i.e., controls exist to adequately prevent detect and correct misstatements in the fmancial statements). It also is our understanding that if the auditor prepares the fmancial statements for the unit as a matter of convenience only, there is no fmding if the unit has the ability to prepare the statements but simply chooses not to do so. In order for the auditor to assist in the preparation of the draft financial statements and notes, and maintain his/her independence, the unit of government must take responsibility for the statements and notes. The fact that the auditor is contracted to draft the fmancial statements may be an indication of a potential control deficiency. The auditor cannot be a control and remain independent. Therefore the unit of government must have someone that possesses the necessary accounting expertise to prevent, detect, and correct a potential misstatement in the financial statements or notes drafted by the auditor (i.e., to take responsibility for the internal controls related to the preparation of the financial statements). This may be someone employed within the unit of government, or Memorandum No. 1077 C August 1, 2007 -~ Page 4 of 7 outsourced, that the auditor concludes, in their professional judgment, is capable of preventing, detecting, and correcting a potential misstatement in the financial statements or notes. Small governments in North Carolina most likely have competent finance staff able to perform the day to day functions of the financial department but may not have staff with the technical ability to prevent, detect, and correct a potential misstatement in the financial statements and notes drafted by the auditor. Therefore, the auditor will carefully evaluate his/her independence and consider the need to report a significant deficiency or material weakness for inadequate design of internal control over the preparation of the financial statements being audited. The LGC has urged auditors to explain this to the government officials so they can understand the role of the auditor and the responsibility of management and their governing board. The LGC staff is aware that the governing boards of local governments may be willing to accept this deficiency, based on their cost/benefit analysis of eliminating this control deficiency. Our office plans to continue, as always, to evaluate the overall fiscal condition of the local government, not just the findings that may be presented by the independent auditor. An action the .unit's board and management may wish to consider to mitigate the control deficiency or material weakness discussed above is to outsource particular accounting-related tasks, including preparation of regular interim financial statements and a draft of the year end statements. Our office maintains a list on our website of accounting firms willing to perform various non-audit services, or the unit may pursue this service from other resources. The benefits of this type of arrangement are many: the unit obtains these services without hiring additional employees, the unit receives timely financial information on a regular basis, which enables the Board and management to make more informed decisions, and often the year-end audit costs are reduced because the bookkeeping is current at year-end or shortly thereafter. Sometimes the audit fee drops enough to cover the cost of contracting out the bookkeeping. A copy of the list of firms is located on our website at http://www.nctreasurer.com. On the Home Page, under State and Local Government, select "Auditing and Reporting Resources." Then, select the link labeled "Accounting Firms Supplying Non-Audit Services" and, once opened, select the firm to retrieve additional information. Converting cash financial statements to accrual basis statements, making audit adjustments, and other non audit services provided by the auditor: The same controls that apply to the drafting of the financial statements may apply to other non-audit services provided by the auditor for the client. The auditor will determine if the government has adequate controls to prevent and detect financial misstatements. Su~~ested guidelines to determine whether a client has sufficient accounting competence and knowledge to detect or prevent a misstatement or mistake: Guidance from the AICPA's frequently asked questions concerning SAS No. 112 states that the auditor is not required to test the competency of their client. However, the competency may be questioned if the auditor is unsure as to whether or not adequate controls are in place to prevent and detect financial statement misstatements. The client may request the auditor to perform certain services for the client's convenience rather than due to lack of competency. If the auditor feels that the unit of government could not perform the service themselves and/or does not have the suitable skills, knowledge, and experience to review the work in such a manner that the unit's control would prevent or detect a material misstatement, a control deficiency has been identified. Memorandum No. 1077 /~ August 1, 2007 (p Page 5 of 7 Designating a person on staff to review financial reports, adjustments, etc.: The AICPA's discussion states that assigning this responsibility to a staff member is not, by itself, an adequate internal control. The internal control lies within the process or procedure that is carried out by an individual or third party to prevent, detect, and correct a potential misstatement. Will the SAS No. 112 Report replace the Management Letter? First, audits performed under Governmental Auditing Standards would not require a separate SAS No. 112 report since the Yellow Book report would disclose any significant deficiencies and/or material weaknesses that are reported. Units receiving Yellow Book audits could be presented additional findings (control deficiencies that don't rise to the level of significant or material weaknesses) in a management letter. Second, audits not performed under Governmental Auditing Standards would receive a SAS No. 112 letter if significant deficiencies and/or material weaknesses exist as identified by the independent auditor. Further, the auditor may list items that are considered control deficiencies, but not significant deficiencies or material weaknesses, in the SAS 112 report or in a separate report. For further information, please refer to Memorandum No. 1070 for additional details regarding SAS No. 112 or please speak with your auditor with specific questions. If there are questions or comments regarding this memorandum, please contact Amy Szalaj at (919) 807-2385 or Amy. Szalaj@nctreasurer.com. Memorandum No. 1077 August 1, 2007 Page 6 of 7 Appendix A List of SAS No. 112 Terminology SAS No. 112 establishes important terms (underlined) that are necessary in understanding this standard. A control delciency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. • A deficiency in design exists when: a) a control necessary to meet the control objectives is missing or b) an existing control is not properly designed so that, even if it operates as designed, the control objective is not always met. • A deficiency in operation exists when a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or qualifications to perform the control effectively. Control deficiencies may involve one or more of the five interrelated components of internal control: a) the control environment, b) risk assessment, c) control activities, d) information and communication, and e) monitoring. A significant deficiency is a control deficiency, or a combination of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity's financial statements that is more than inconsequential will not be prevented. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented. A compensating control is a control that limits the severity of a control deficiency and prevents it from rising to the level of a significant deficiency or a material weakness. Compensating controls operate at a level of precision, considering the possibility of further undetected misstatements that would result in the prevention or detection of a misstatement that is more than inconsequential or material to the financial statements. Although compensating controls mitigate the effects of a control deficiency, they do not eliminate the control deficiency. Internal control is a process, affected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the objectives which includes reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations. The term those charged with governance is "the person(s) with responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity. This includes overseeing the financial reporting and disclosure process." This would be the governing board of directors, a committee of board of directors (e.g., an audit committee), or a committee of management (e.g., finance or budget committees). Memorandum No. 1077 August 1, 2007 Page 7 of 7 Appendix B List of common controls evaluated for deficiencies Based on the lists provided in SAS No. 112, these deficiencies may be commonly noted. • Ineffective overs~ht of the entity's financial reporting and internal control by those charged with governance. • Restatement of previously issued financial statements to reflect the correction of a material misstatement, which includes misstatements due to error or fraud. • Controls over the period-end financial reporting process, including controls over procedures used to enter transaction totals in the general ledger; initiate, authorize, record, and process journal entries into the general ledger; and record recurring and nonrecurring adjustments to the financial statements. • Inadequate design of internal control over a significant account or process. • Inadequate design of monitoring controls used to assess the design and operating effectiveness of the entity's internal control over time. • Inadequate documentation of the components of internal control. • Failure in the operation of effectively designed controls over a significant account or process. • Insufficient control consciousness within the organization, for example, the "tone at the top" and the control environment. • Failure by management or those charged with governance to assess the effect of a significant deficiency previous communicated to them and either correct it or conclude that it will not be corrected. • Absent or inadequate segregation of duties within a significant account or process. • Controls over the selection and application of accounting_princi les that are in conformity with generally accepted accounting principles. Having sufficient expertise in selecting and applying accounting principles is an aspect of such controls. • Employees or management who lack the qualifications and training; to fulfill their assigned functions. For example, in an entity that prepares financial statements in accordance with generally accepted accounting principles, the person responsible for the accounting and reporting function lacks the skills and knowledge to apply generally accepted accounting principles in recording the entity's financial transactions or preparing its financial statements. • Failure of the information and communication component of internal control to provide complete and accurate output because of deficiencies in timeliness, completeness, or accuracy; for example, the failure to obtain timely and accurate consolidating information from remote locations this needed to prepare the financial statements. • Failure of controls designed to safeguard assets from loss damage, or misappropriation. • Failure to perform reconciliations of significant accounts. For example, accounts receivable subsidiary ledgers are not reconciled to the general ledger account in a timely'or accurate manner.