Nonprofit audit standards make it management’s responsibility, not the auditor, to establish and maintain proper internal controls.
Nonprofit Audit Standards Pinpoint Internal Control Deficiencies
When the American Institute of Certified Public Accountants released its new audit standards (Statements of Audit Standards – SAS) in 2006, it had a profound affect on nonprofit organizations. SAS 112 – Communicating Internal Control Related Matters Identified in an Audit redefines the types of internal control issues that will be reportable. In the past, you may have seen the terms “reportable condition” and “material weakness” in your audit reports. The term “reportable condition” is no longer used. Instead, the term “significant deficiency” is used. The term “material weakness” is still used, but its definition has changed.
According to the SAS, a control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Control deficiencies are further categorized as deficiencies in design or deficiencies in operation.
What are Control Deficiencies
- A deficiency in design exists when a control necessary to meet the control objectives is missing, or an existing control is not properly designed so that even if it operates as designed, the control objective is not always met. Off-the-shelf accounting software does not have the proper internal controls to meet this SAS requirement. For example, in QuickBooks, you can easily change a transaction even if it clears the bank, or is in closed accounting period. This would be classified in your audit report as a significant deficiency.
- A deficiency in operation exists when a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or qualifications to perform the control effectively. This is a perfect example of the deficiency inherent in off-the-shelf accounting software in their inability to generate financial statements for your audit. Under these new audit guidelines, if your auditor has to create the financial statements for your audit, then it will be reported as a deficiency in operation on your audit report.
- A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP such that there is more than a remote likelihood that a misstatement of the entity’s financial statements that is more than inconsequential will not be prevented or detected. Since most reports need to be created outside of the accounting software used by nonprofits, in programs like Excel, there is more of a risk that the audit will report a significant deficiency in their audit report.
Examples of Control Deficiencies
A poorly prepared financial report can lead to incorrect financial information being shared with management or board members and inaccurate reporting to the IRS. This can result in penalties, worse yet material fraud, including misappropriation of funds.
Financial Risk Management involves implementing procedures to prevent or detect misstatements of the nonprofit’s finances. Here are some examples of control deficiencies and consequences:
- If there aren’t adequate systems in place that can help employees or management prevent or detect misstatements of the nonprofit’s financial position.
- If the same employee opened the mail and logged-in checks received, processed deposits, approved expenses and reconciled bank statements.
- If a nonprofit doesn’t not have staff members capable of preparing financial statements that conform with Generally Accepted Accounting Principles.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected.
We value your comments! Feel free to ask questions, suggestions or leave feedback.