Speaker 1: In this video, we take a look at how to communicate internal control weaknesses. So as you perform audits, sometimes you bump into material weaknesses, sometimes you run into significant deficiencies, and other times you run into what we will call other deficiencies. We're going to take a look at how you can properly identify internal control weaknesses and then after they're identified, how you can communicate those in an appropriate way. So we're going to take a look at how to discover control deficiencies. After that, we'll take a look at how to capture them. And then finally, we'll look at how to communicate those weaknesses. First up, how to discover control weaknesses. The main point I want to make here in terms of capturing is to do so as you identify the control weakness. You know, so many times we're doing the audit, we get busy, and we bump into a control weakness, but then we forget to document what we're seeing. And then two, three, four weeks later, we're trying to describe that control weakness so we can communicate it to management. And we struggle because we didn't properly capture that control weakness when we first saw it. Now there's three main places you're going to identify control weaknesses. The first is in the planning or the risk assessment stage of the engagement. I find that when I do walkthroughs, I run into control weaknesses. I bet that's your experience as well. And then sometimes I'm doing the transaction level work. That's the second area of the field work. I'm doing the detailed substantive work, and I run into issues there. We're going to see how that plays out. And then finally, as I'm wrapping up the audit, again, even there, I'll run into control weaknesses. So let's suppose we're looking at cash receipts, and we're doing the walkthrough, and we see that only one person opens the mail. And that one person could easily steal funds because there's nobody else around to observe what that person is doing. So we see an internal control weakness. So as you're doing your walkthroughs, whether it's in cash or payables or debt or whatever, you're going to run into control weaknesses. And I want to encourage you to go ahead and capture that control weakness as soon as you see it. One of the things you're looking at in a walkthrough is whether or not the entity has appropriate segregation of duties. And I'll look at segregation of duties in terms of four factors. One, custody of assets. Two, reconciliations, who's performing those reconciliations. Three, authorization, who's authorizing the transaction. And then finally, bookkeeping. Now you'll notice C-R-A-B are the first letters of these four factors, and that spells crab. Maybe it's corny, but this is how I remember the different pieces that need to be segregated in an accounting system. Now as you consider segregation of duties, look at the slide here, and you'll see that sometimes when segregation is lacking, there could be a material weakness. In other words, a material amount of money or assets could be stolen. On the second bullet, you see a situation where the amount that could be stolen is not material. If that's your situation, then you probably have a significant deficiency. And then if there's only a potential for theft of insignificant amounts, we'll put that in the third category, which is an other deficiency. So the three potential deficiencies are material weakness, significant deficiency, and other deficiency. Now I'm just using segregation of duties as an example of how you would identify the control weakness and then classify the internal control weakness into one, either a material weakness, two, a significant deficiency, or three, an other deficiency. Now it's important that you categorize the control weakness in the right manner, because the first two, material weaknesses and significant deficiencies, we're going to see later on that you have to communicate those in writing. The other deficiencies, those that are not material weaknesses or significant deficiencies, can be communicated verbally. We'll talk more about that in a little. As you perform your walkthroughs, we need to understand that we're not just looking for where theft might occur. We're also looking for where errors might occur. So there's only two ways that misstatements occur. Either there's fraud, sometimes we'll have somebody cooking the books or stealing assets, or two, the second way is through error. So as you do your walkthroughs, be thinking about the first, which is the fraud potential, but also think about errors and how those could create a material misstatement. Some of the questions you might ask as you're doing the walkthrough is, do the monthly financial statements ever contain errors? You might ask the controller this question. You might ask, are invoices mistakenly omitted from the payable system? Or you might ask, do employees forget to obtain purchase orders? So these are some of the ways that errors can occur. And if they can occur, then you've got a control deficiency. And again, if you have a control deficiency, we're going to capture that so that we can communicate that potential problem later on. We've been talking about the planning stage. Let's shift gears now and talk about the fieldwork stage and how you might identify control weaknesses in this part of the engagement. Sometimes you're looking at, say, accounts payable or maybe inventory, and you're doing a test of details in the fieldwork stage, and you identify a difference there. Let's say it's a half million dollars, and you propose an audit adjustment. And let's suppose that your materiality is $300,000. Well, you just proposed an adjustment that is greater than materiality. So that tells us there's a material weakness in relation to the controls. Otherwise, there wouldn't be a material adjustment made as you conduct the fieldwork stage of the engagement. So as you create your proposed audit journal entries, especially if these amounts are material, ask yourself, what's the control weakness that allowed this misstatement to occur? And that misstatement can be from theft or fraud, or it could be an error. But either way, if you propose an audit adjustment and it's legitimate, then you have a control weakness by default. Now let's shift gears and talk about the conclusion stage of the engagement. Sometimes when you get to this part of the audit, you start putting all the pieces together, and lo and behold, you become aware of a control weakness that you didn't know existed. And then other times, you've documented, captured the internal controls as you've done the planning and the fieldwork. And then when you get to the conclusion stage, you're simply going back and looking at those documented internal control weaknesses. When you get to this stage and you're going to communicate the internal control weaknesses, you want to make sure that you've got your top people doing this, because you're about to communicate control weaknesses that may reflect poorly upon management, such as the controller or the CFO or other people in accounting. They may not be real happy that you found these control weaknesses, because they either helped design the internal controls, or at a minimum, they're overseeing the use of those controls on a day-to-day basis. So you want to be very tactful and careful as you communicate the internal control weaknesses at the conclusion stage of the engagement. So you can see from my slide here, you may want to desire to have a policy in your firm that only managers or partners make these communications, because you want to make sure this part goes well. Now it's interesting that the communication of the internal control weaknesses can be difficult and kind of touchy, but at the same time, to the opposite side of this picture, think about this as an opportunity to create value in the audit engagement. As you identify internal control weaknesses and you communicate those in a tactful manner, then management can go after you're gone and correct these internal control weaknesses. If they do, then there's a lot less opportunity for material misstatements to occur in the business. So that's helpful to the business. It's also helpful to you next year when you do this audit again. So we've covered how to discover the internal control weaknesses. Now I want to turn to the second part of this, which is how to capture them, and stay with me because this is important as well. So I said this earlier, but I'm going to repeat myself on purpose because this is critical. When you see the internal control weakness and you identify it, go ahead and capture it, and you want to put the internal control weakness on a form, and hopefully your firm has an internal control weakness form. If you don't have one, I'd encourage you to create one, but on that form, I'm going to show you what you want to identify, but my main point now is capture the internal control when you see it. So what should be on this internal control form? You could create one in Excel or Word, but these are the things that at a minimum I would include on your form. When you want a place to designate or classify the internal control weakness as a significant deficiency, a material weakness, or another control deficiency, you might have a fourth category for potential violations of laws or regulations or controls that would allow violations of laws or regulations. You also want on there whether the probability of occurrences is at least reasonably possible. If it is, then you may have a material weakness. Third, you want a description of the deficiency and whether or not that was communicated in writing or verbally. Fourth, you want the cause of the condition. What allowed that internal control weakness to exist? Five, the potential effect of the condition. So if the company doesn't fix this control weakness, what might happen? What's the potential effect? Six, what's the recommendation to correct the internal control weakness? Seven, who's the person that identified the issue and the date of the discovery? Now that's the person on your audit team that identified the control weakness and the date that they made that discovery. Number eight, whether the issue is a repeat offense. So if they had the control weakness last year and then they have it again this year, you want to know that. And then nine, an area for the partner to sign off that he or she agrees with the information that's been documented. Then finally, a reference to the related documentation in the audit file. So these are the things, the ten things that I would put on the internal control weakness form. And you know, if you're using somebody like PPC or McGladrey or whatever, they're providing a form for this purpose. You could certainly use those. Those are well-designed. But if you don't have a form, then you can create one like this. Now let's go to that third part of dealing with internal control weaknesses. And this is the piece where we communicate what we have identified and then what we've captured on the internal control weakness form. Now I said this earlier, but I'm going to repeat it. If you have a material weakness or a significant deficiency, you have to communicate those in writing. So you'll want to create a letter that communicates these weaknesses. If you have other deficiencies, those that are not material weaknesses or significant deficiencies, you can put those in writing or you can just communicate verbally. If you elect to communicate the other deficiencies verbally, then you want to document those discussions in your work papers. So I'm going to close by saying that identifying, capturing, and communicating internal control weaknesses is one of the more important things that you will do in an audit engagement. So if you don't have an internal control form, go ahead and create one with the 10 points that we've discussed in this video. And then the last thing I'll say, which I think is the most important, is make sure you communicate clearly with those that are related to the control weakness issue. In other words, if the controller is involved in a situation where there's a material weakness, you want to have that conversation with the controller. Because we as auditors can make mistakes. Sometimes we think there's a control weakness and there's really not. By having that conversation, we avoid the egg on our face when we communicate something that's really not true. So make sure you have those conversations. Make sure you provide the draft of the written communication about control weaknesses to management. Let them vet it before we disseminate it, say, in a board meeting or anywhere else. So I hope you found this video helpful and I wish you well as you identify, capture and communicate internal control weaknesses in your audit engagements. Take care. I'll talk to you soon. Bye now.