Section Significant Deficiencies in Internal Con - ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009 - Significant Deficiencies in Internal Control (Ref: Para. 6(b), 8) | Zoe
ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009
Significant Deficiencies in Internal ConSignificant Deficiencies in Internal Control (Ref: Para. 6(b), 8)
Start here
Get a plain-English read of Significant Deficiencies in Internal Con
Turn the raw legal text into a practical explanation grounded in ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009.
Significant Deficiencies in Internal Control (Ref: Para. 6(b), 8)
The significance of a deficiency or a combination of deficiencies in internal control depends not only on whether a misstatement has actually occurred, but also on the likelihood that a misstatement could occur and the potential magnitude of the misstatement. Significant deficiencies may therefore exist even though the auditor has not identified misstatements during the audit.
Examples of matters that the auditor may consider in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:
The likelihood of the deficiencies leading to material misstatements in the financial report in the future.
The susceptibility to loss or fraud of the related asset or liability.
The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates.
The financial report amounts exposed to the deficiencies.
The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to the deficiency or deficiencies.
The importance of the controls to the financial reporting process; for example:
General monitoring controls (such as oversight of management).
Controls over the prevention and detection of fraud.
Controls over the selection and application of significant accounting policies.
Controls over significant transactions with related parties.
Controls over significant transactions outside the entity’s normal course of business.
Controls over the period‑end financial reporting process (such as controls over non‑recurring journal entries).
The cause and frequency of the exceptions detected as a result of the deficiencies in the controls.
The interaction of the deficiency with other deficiencies in internal control.
Indicators of significant deficiencies in internal control include, for example:
Evidence of ineffective aspects of the control environment, such as:
Indications that significant transactions in which management is financially interested are not being appropriately scrutinised by those charged with governance.
Identification of management fraud, whether or not material, that was not prevented by the entity’s internal control.
Management’s failure to implement appropriate remedial action on significant deficiencies previously communicated.
Absence of a risk assessment process within the entity where such a process would ordinarily be expected to have been established.
Evidence of an ineffective entity risk assessment process, such as management’s failure to identify a risk of material misstatement that the auditor would expect the entity’s risk assessment process to have identified.
Evidence of an ineffective response to identified significant risks (for example, absence of controls over such a risk).
Misstatements detected by the auditor’s procedures that were not prevented, or detected and corrected, by the entity’s internal control.
Restatement of a previously issued financial report to reflect the correction of a material misstatement due to error or fraud.
Evidence of management’s inability to oversee the preparation of the financial reports.
Controls may be designed to operate individually or in combination to effectively prevent, or detect and correct, misstatements.[5] For example, controls over accounts receivable may consist of both automated and manual controls designed to operate together to prevent, or detect and correct, misstatements in the account balance. A deficiency in internal control on its own may not be sufficiently important to constitute a significant deficiency. However, a combination of deficiencies affecting the same account balance or disclosure, assertion, or component of the entity’s system of internal control may increase the risks of misstatement to such an extent as to give rise to a significant deficiency.
Law or regulation in some jurisdictions may establish a requirement (particularly for audits of listed entities) for the auditor to communicate to those charged with governance or to other relevant parties (such as regulators) one or more specific types of deficiency in internal control that the auditor has identified during the audit. Where law or regulation has established specific terms and definitions for these types of deficiency and requires the auditor to use these terms and definitions for the purpose of the communication, the auditor uses such terms and definitions when communicating in accordance with the legal or regulatory requirement.
Where the jurisdiction has established specific terms for the types of deficiency in internal control to be communicated but has not defined such terms, it may be necessary for the auditor to use judgement to determine the matters to be communicated further to the legal or regulatory requirement. In doing so, the auditor may consider it appropriate to have regard to the requirements and guidance in this Auditing Standard. For example, if the purpose of the legal or regulatory requirement is to bring to the attention of those charged with governance certain internal control matters of which they should be aware, it may be appropriate to regard such matters as being generally equivalent to the significant deficiencies required by this Auditing Standard to be communicated to those charged with governance.
The requirements of this Auditing Standard remain applicable notwithstanding that law or regulation may require the auditor to use specific terms or definitions.