Part 5: What if a Control Deficiency is Identified During an Audit?

by Diane M. Zimmerman, CPA, Director, Baden, Gage & Schroeder, LLC

The auditor's evaluation of internal control allows the auditor to identify some, but not all, of the deficiencies that may exist in the design of the entity's internal control.  The scope of the auditor's evaluation is limited to the design of an entity's internal control.  Deficiencies may exist in the way a control procedure is performed, but the nature of the auditor's work is such that these deficiencies may not be detected as part of the financial statement audit. 

The Severity of a Control Deficiency

When a gap is identified in the design of internal control, the auditor must evaluate the relative significance by determining whether it is a "material weakness (severe)," "significant deficiency (less severe)," or "inconsequential.  To make this determination, the auditor will assess:

• The likelihood that a misstatement of the financial statements could exist as a result of the control deficiency.
• The magnitude of the misstatement that could occur.

 In general, as the likelihood and magnitude of the possible misstatement increases, the relative severity of the control deficiency also increases.  Determining the relative significance of a control deficiency requires auditors to exercise professional judgment.  However, certain conditions are described in the standards as being strong indicators of significant deficiencies or material weaknesses.  For example, a lack of management oversight of the financial reporting process is viewed as a significant deficiency at a minimum and may be considered a material weakness.

Written Communication of Internal Control Deficiencies

Auditors are required to communicate in writing all material weaknesses and significant deficiencies identified during the audit.  Generally, these will be communicated in a letter at the conclusion of the audit.  In some circumstances, management may already be aware that the entity's control system contains a control deficiency and has made a conscious decision to accept the risk posed by that deficiency because of cost or other considerations.  Nevertheless, professional standards require the auditor to communicate such deficiencies in the same manner.

In order to establish and maintain internal control, management can be actively involved in its five components:

• Identifying "what can go wrong"
• Implementing controls to manage risk
• Monitoring control performance
• Communicating information
• Establishing an effective control environment

By being actively involved in the internal control process, the number of control deficiencies identified by the auditor can be minimized.