Statement on Auditing Standards No. 115
Communicating Internal Control-Related Matters Identified
in an Audit
(Formerly SAS 112)
SAS 115 provides guidance to external auditors regarding how they should communicate internal control-related matters identified in their audit of an organization's financial statements. SAS 115, which was issued by the American Institute of Certified Public Accountants (AICPA) in October 2008, superseded SAS 112.
How Does SAS 115 Affect the Berkeley Campus?
The standard applies to the university's external auditor, PricewaterhouseCoopers (PwC). Because PwC is required to perform certain procedures under SAS 115 when auditing the Berkeley campus, the campus has elected to undertake certain complimentary activities – specifically, the identification and monitoring of key financial controls that, if designed and carried out effectively, will reduce the likelihood of incurring a material misstatement in the campus's financial statements.
Summary of What SAS 115 Contains
The standard does three things:
- It defines three categories of deficiencies that may be identified
during the external audit of the financial statements:
- Control deficiencies
- Significant deficiencies
- Material weaknesses
- It provides guidance on evaluating the severity of the deficiencies identified.
- It requires the auditor to communicate in writing to management and those charged with governance any significant deficiencies or material weaknesses that were identified.
Definitions of Control Deficiencies
SAS 115 defines three categories of deficiencies as described below. The nature of the deficiency is a function of the seriousness of its potential impact on the financial statements.
- Control Deficiency
- A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.
- Significant Deficiency
- A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
- Material Weakness
- A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected on a timely basis.
Indicators of a Material Weakness
SAS 115 includes a list of deficiencies in internal control that are indicators of material weaknesses. The list of indicators are:
- Identification of fraud, whether or not material, on the part of senior management;
- Restatement of previously issued financial statements to reflect the correction of a material misstatement due to error or fraud;
- Identification by the auditor of a material misstatement of the financial statements under audit in circumstances that indicate that the misstatement would not have been detected by the entity's internal control; and
- Ineffective oversight of the entity's financial reporting and internal control by those charged with governance.
SAS 115 is effective for audits of financial statements for periods ending on or after December 15, 2009.