Deficiency in internal control
This exists when:
a) A control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or
b) A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing.
Significant deficiency in internal control
A deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance.
Note:- Auditor considers Internal Controls only to determine NTE of Audit procedures, but not to express opinion on effectiveness of Internal controls.
Factors to be considered in determining whether a deficiency constitutes a significant deficiency
1) The likelihood of the deficiencies leading to material misstatements in the financial statements in the future.
2) The susceptibility to loss or fraud of the related asset or liability.
3) The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates.
4) The financial statement amounts exposed to the deficiencies.
5) The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to the deficiency or deficiencies.
6) The interaction of the deficiency with other deficiencies in internal control
Communication Process
1) The auditor shall determine whether, on the basis of the audit work performed, the auditor has identified one or more deficiencies in internal control.
2) If the auditor has identified one or more deficiencies in internal control, the auditor shall determine whether, individually or in combination, they constitute significant deficiencies.
3) The auditor shall communicate in writing significant deficiencies in internal control identified during the audit to those charged with governance on a timely basis.
4) The auditor shall also communicate to management at an appropriate level of responsibility on a timely basis:
a) In writing, significant deficiencies in internal control that the auditor has communicated or intends to communicate to TCWG, unless it would be inappropriate to communicate directly to management
b) Other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that, in the auditor’s professional judgment, are of sufficient importance to merit management’s attention.
Contents of Written Communication
The auditor shall include in the written communication of significant deficiencies in internal control:
1) A description of the deficiencies and an explanation of their potential effects; and
2) Sufficient information to enable TCWG and management to understand the context of the communication. In particular, the auditor shall explain that:
a) The purpose of the audit was for the auditor to express an opinion on the financial statements;
b) The audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control; and
c) The matters being reported are limited to those deficiencies that the auditor has identified during the audit and that the auditor has concluded are of sufficient importance to merit being reported to those charged with governance.