The American Institute of Certified Public Accountants released new audit standards (Statements of Audit Standards - SAS) that has a profound affect on nonprofit organizations and the software they use for their financial management. SAS 112 - Communicating Internal Control Related Matters Identified in an Audit redefines the types of internal control issues that will be reportable. In the past, you may have seen the terms “reportable condition” and “material weakness” in your audit reports. The term “reportable condition” will no longer be used. Instead, the term “significant deficiency” will be used. The term “material weakness” will still be used, but its definition has changed.
Internal Control is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.
In simple terms, according to the SAS, a control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Control deficiencies are further categorized as deficiencies in design or deficiencies in operation.
For example, a deficiency in design exists when a control necessary to meet the control objectives is missing, or an existing control is not properly designed so that even if it operates as designed, the control objective is not always met. Off-the-shelf accounting software does not have the proper internal controls to meet this SAS requirement. For example, in QuickBooks, you can easily change a transaction even if it clears the bank, or is in closed accounting period. This would be classified in your audit report as a significant deficiency.
A deficiency in operation exists when a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or qualifications to perform the control effectively. This is a perfect example of the deficiency inherent in off-the-shelf accounting software in their inability to generate financial statements for your audit. Under these new audit guidelines, if your auditor has to create the financial statements for your audit, then it will be reported as a deficiency in operation on your audit report.
A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP such that there is more than a remote likelihood that a misstatement of the entity’s financial statements that is more than inconsequential will not be prevented or detected. Since most reports need to be created outside of the accounting software used by nonprofits, in programs like Excel, there is more of a risk that the audit will report a significant deficiency in their audit report.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected.
The SAS also requires us auditors to communicate, in writing, to management and those charged with governance, the significant deficiencies and material weaknesses identified during the audit. In most cases, this will include your governing board.
If your organization is using off the shelf accounting software, like QuickBooks or Peachtree, even their nonprofit versions, it is likely that more audit findings will be reportable. The SAS clarifies that the significance of a control deficiency is dependent on the potential for a misstatement, not whether a misstatement actually occurred. Also, the potential misstatement does not have to be a material misstatement; it just has to be “more than inconsequential.” If more findings are reported, you will spend more time correcting and tracking the status of these findings. All of this translates into increased audit fees, the potential for negative reports in your audit and the risk of losing funding from your funding sources.
Using true fund accounting software, like FastFund Online will help to eliminate the potential internal control deficiencies inherent in off-the-shelf accounting software.
FastFund Nonprofit Accounting software includes the following features that are not available in off-the-shelf applications:
These features will help your organization demonstrate proper internal controls and minimize the potential of adverse findings in your audit. An investment in FastFund Online will ultimately save you thousands of dollars for your audits and help guarantee the financial well being of your organization.