Presentation on theme: "Arizona’s First Year SAS 112 Experience from the Audit Side"— Presentation transcript:
1 Arizona’s First Year SAS 112 Experience from the Audit Side Upside-down ThinkingArizona’s First Year SAS 112 Experience from the Audit SidePresented by: Keith DommerNSAA/NASC Joint Middle Management ConferenceSpringfield, Illinois14 April 2008
2 SAS 112 in Arizona We’re following a common project cycle Plan Arizona ExperimentImplementHow-To-Report Decision – Related Risks and QuirksEvaluateNo change in number or types of findingsAdjust as neededSAS 112 Tool ModificationsQuality Control Process RevisionsAdditional Trainings
3 Our Experiment Take all the financial statement audits issued in 2006 P L A N N I N GTake all the financial statement audits issued in 200623 audits – 1 qualified opinionSummarize all findings into their four “buckets”Material weaknesses, reportable conditions, management letter items, Points for DiscussionRe-categorize the findings under the new criteria of SAS No. 112Material weaknesses, reportable conditions, management letter items, points for discussion
4 Our Experiment—Results P L A N N I N G50100150200250300350400Pre-SAS112Using SASMaterial weaknesses332Reportable conditions/significantdeficiencies11156Management letter items6578Points for discussion340185Pre-SAS 112Using SAS 112Huge percentage increases in material weaknesses and significant deficienciesMaterial weaknesses % 29 more findingsSignificant deficiencies % 145 more findingsManagement letter % 13 more findingsPoints for discussion (46)% 155 less findingsTotal % 32 more findingsAdded 32 more findings than accumulated during the audit—attributed to specific control deficiencies identified in the new SAS that existed during our audits, but did not affect our opinion on the statements, so never writtenRemember that we only had one modified report. This doesn’t change the opinions we gave. It merely proves what we've been hearing about this new SAS and the impact it may have.79 publicly reported findings increased to 266 publicly reported findings. These are all subjected to our entire quality control process – we considered adding a new position of Report Writer to handle the volume of findings.
5 SAS 112 ImplementationI M P L E M E N T A T I O NImplementation Committee made two major decisions:We eliminated management letters.Yellow Book report would be our SAS 112 communicationSAS 112 implementation would not be driven by the addition of more forms.We would give implementation guidance in a useful ‘tool’
6 AZ Reports: Pre-SAS 112 Auditor’s financial statement report I M P L E M E N T A T I O NAuditor’s financial statement reportAdditional Single Audit Reports– YB report bound insideManagement lettersPoints for discussion
7 Additional Single Audit Reports AZ Reports: Post-SAS 112I M P L E M E N T A T I O NAuditor’s financial statement reportYellow Book reportAdditional Single Audit ReportsNo more management lettersPoints for discussion (presented orally)
8 EvaluationE V A L U A T I O NAfter our first eight 2007 engagements have been issued, we found:No significant change in the number of reported findings after implementing SAS 112.
9 Identified Reasons Not troublesome: E V A L U A T I O NNot troublesome:Experiment presented the ‘worst-case’ scenarioClients got the message, emphasizing and allocating resources to improve internal controlCurrent results are from clients that value financial reporting and internal controlInsufficient information was gathered in the prior audit to fully evaluate findings
10 Identified Reasons Upside-down Thinking E V A L U A T I O NPresumption by staff that findings do not meet reporting requirements unless criteria indicate they should be reported.When judgment about a finding could go either way, staff elected to not report the finding.Troublesome:Upside-down Thinking
11 Identified Reasons Also Troublesome: E V A L U A T I O NAlso Troublesome:“Magnitude” suggests a quantified evaluation – qualitative factors were under-evaluated and not considered FIRSTCertain COSO slices are difficult to evaluate in SAS 112 termsDesign deficiencies are difficult to evaluateCompensating controls mitigated significance without sufficient appropriate audit evidenceFinding evaluations performed almost exclusively by auditors close to the audit
12 AZ OAG SAS 112 Tool A Multiple Tab Workbook Table Definitions A D J U S T M E N T SA Multiple Tab WorkbookTableDefinitionsMateriality/Magnitude MeterProcessFinding Index and Evaluation SpreadsheetA-133 Single Audit GuidanceExamplesResources
13 SAS 112 Table A D J U S T M E N T S Not Possible Remote SAS 112 Reporting TableMagnitude of Possible Misstatement Qualitative Factors Must be Considered When Assessing MagnitudeNo F/S EffectInconsequentialMore than InconsequentialMaterialLikelihood of MisstatementNot PossibleNot a Control DeficiencyRemoteOther Control DeficiencyMore than RemoteSIGNIFICANT DEFICIENCYMATERIAL WEAKNESS
14 Related Definitions Design Deficiency Materiality Magnitude A D J U S T M E N T SDesign DeficiencyA type of control deficiency for which a necessary control is missing or the control will not meet the objective even if performed as designed.MaterialityMateriality refers to whether a misstatement is significant enough to change or influence the judgment of a reasonable person relying on the information. Materiality includes qualitative factors such and the nature of the item and the related surrounding circumstances as well as quantitative factors. For a discussion of materiality, please see the Materiality Meter tab.MagnitudeMagnitude refers to the significance of the possible misstatement and includes qualitative factors such as the nature of the misstatement and the surrounding circumstances. It includes actual noted misstatements and any other misstatement that could have occurred. When considering magnitude, it does not matter whether an actual misstatement was noted. What matters is the potential for misstatement. When making magnitude determinations, please see the Materiality Meter tab.InconsequentialMagnitude is inconsequential if a reasonable person would conclude that the possible misstatement (any actual misstatement plus potential undetected misstatements) would clearly be immaterial to the financial statements, qualitatively and quantitatively. When determining whether an item is inconsequential, please see the Materiality Meter tab.Prudent OfficialAlthough the term prudent official is not defined in the standard, the concept is that an auditor should step back and take an objective look at the severity of the deficiency like a regulator or a person from an oversight agency would do.
15 The SAS 112 Process Government Auditing Standards 5.12 A D J U S T M E N T SAdditions and Clarifications to the SAS 112 Process Outline:Government Auditing Standards 5.12Fixing the UPSIDE-DOWN THINKINGPrudent Official Test
16 Finding Index and Evaluator A D J U S T M E N T SAffected Financial Statement AreaCompliance and Other MattersDispositionLOR #Audit Documentation ReferenceDescriptionPrior Year Finding?Account BalanceDisclosure RequirementAssertionInternal Control ComponentNonfederal Compliance?Fraud, Illegal Act, or Abuse?A-133Yellow Book ReportVerbal CommunicationPassFederal Compliance?CFDA NumberCompliance RequirementMaterial WeaknessSignificant DeficiencyInstance of Non-complianceOther MatterVerbal PFDDate Discussed with ClientAffected Financial Statement AreaAccount BalanceDisclosure RequirementAssertionInternal Control ComponentDispositionYellow Book ReportVerbal CommunicationPassMaterial WeaknessSignificant DeficiencyOther MatterVerbal PFDDate Discussed with Client
17 More than Inconsequential Materiality MeterA D J U S T M E N T SMATERIALITY (MAGNITUDE) METERInconsequentialThe magnitude of a control deficiency is inconsequential if a reasonable person would conclude that the misstatement would be clearly immaterial to the financial statements.To make these determinations, the auditor must consider any actual misstatement, the possibility of further undetected possible misstatements, and the effects of any other related control deficiencies.More than InconsequentialThe magnitude of a control deficiency is more than inconsequential if a reasonable person would not conclude that a misstatement was inconsequential.MaterialThe magnitude of a control deficiency is material if the misstatement makes in probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the misstatement.INFORMATION NEEDED TO HELP MAKE THESE DETERMINATIONSAAG-SLV 4.30Materiality refers to whether a misstatement is significant enough to change or influence the judgment of a reasonable person relying on the information.INCONSEQUENTIAL MORE THAN INCONSEQUENTIALMATERIAL
18 A-133 Single Audit Guidance A D J U S T M E N T SComplete Summary of A-133 Finding ReportingInput on significance of findings from Inspectors GeneralThe $400 Questioned Cost Hypothetical Scenario
19 Summary We haven’t seen the expected increase in findings We analyzed why and identified:Reasons that didn’t need correctionReasons that did need correctionUPSIDE-DOWN THINKINGCorrectionsAZ SAS 112 Tool modifications and training