2. Implementing SAS 112 Thomas H. McTavish, C.P.A. Auditor General State of Michigan

3. Effective Dates SAS 112 and SAS 113 paragraphs 7-14 are effective for audits of financial statements ending on or after December 15, 2006. SAS 104-111, SAS 113 paragraphs 1-5 and SAS 114 are effective for audits of financial statements beginning on or after December 15, 2006.

4. SAS 112 SAS 112 requires auditors to report certain internal control deficiencies, in writing to management, within 60 days of the release of the auditors report.

5. Significant Deficiency A significant deficiency is one or more control deficiencies causing a condition in which it is at least possible that a financial misstatement that a reasonable person would think is more than clearly immaterial could occur without being prevented or detected.

6. Examples of Significant Deficiencies Only the potential for a misstatement, not an actual occurrence, is needed to meet these definitions. Insufficient controls or expertise over selecting GAAP. Insufficient antifraud programs or controls Inadequate controls over non-routine or non- systematic transactions.

7. Material Weakness A material weakness is one or more significant deficiencies causing a condition in which it is at least possible that a financial misstatement that is material could occur without being prevented or detected.

8. Examples of Material Weakness Only the potential for a misstatement, not an actual occurrence, is needed to meet these definitions. Ineffective financial reporting or internal control oversight by management. Material misstatements identified by the auditor, even if corrected. Entities failure to address previously reported significant deficiencies.

9. Anticipated Audit Impact Our threshold for a reportable condition was close to the new definition for significant deficiencies. Therefore, we did not expect to see a significant increase in the number of control deficiencies reported. The standard (paragraph 19) does identify specific situations that should be regarded as at least a significant deficiency. We determined that we may see some impact related to these items.

10. Preparation to Implement Trained Staff Updated policies, procedures, engagement letters and report letters. Informed auditee management.

11. OAG Experience State of Michigan CAFR Changed Management letter report processing Issued formal audit memos addressing significant deficiencies during field work. Did not have significant impact on number of findings reported. Agency found early notification of changes and early notification of issues helpful.

12. Financial Audits Changed engagement letter and report letter terminology. Did not have a significant impact on number of findings reported. Examples One instance where auditors found error that was not detected by management Management questioned whether finding met significant deficiency definition.

13. Single Audits Changed engagement letter and report letter terminology. Single audits are still in process, however, we are not expecting a significant impact on the number of findings reported.

14. Additional Risk Standards SAS 104-111 relates to the auditors assessment of internal controls throughout the entire audit process. These standards may result in the identification of more significant deficiencies. SAS 113 is an omnibus standard that changes terminology in existing standards so that it agrees with the SAS 112 and the new risk standards.

15. Additional Risk Standards SAS 114 relates to the communication of internal control deficiencies to those charged with governance (oversight of strategic direction) in addition to management (those responsible for achieving goals and setting policy/procedure)

16. QUESTIONS