As companies with Dec. 31 year ends prepare for the 2021 audit season, DHG’s Gareth Montague-Smith and Leslie Bates compiled responses to frequently asked questions (FAQ’s) surrounding companies’ internal control deficiencies and corresponding internal control letter.
Why is the auditor issuing an internal control letter? They aren’t even auditing our controls?!?!
In short, it’s required. AU 325.17 states that “Deficiencies identified during the audit that upon evaluation are considered significant deficiencies or material weaknesses under this section should be communicated, in writing, to management and those charged with governance as a part of each audit, including significant deficiencies and material weaknesses that were communicated to management and those charged with governance in previous audits and have not yet been remediated.”
We didn’t have any deficiencies last year, are we good?
We believe there is a greater potential for more internal control deficiencies and letters to be issued on the Dec. 31, 2020 year end, given all the changes many companies have had to make, resulting from working from home and the implementation of new controls and processes.
Who sees this internal control letter? Can’t I just hide it in my virtual file cabinet?
The letter is addressed to those charged with governance, which may include the Board of Directors, management, owners, etc. We are also seeing an increasing number of lenders and regulators requesting copies of the internal control letter, potentially opening management up to another “round” of questions and clarifications for any adverse comments made by the external auditor. Depending upon the severity of the comments and the financial gravitas of the party reviewing the letter, it has the potential to prompt difficult conversations.
How can I minimize the number of deficiencies in the letter?
It is important for management to “manage” the audit process throughout. Constant communication with external auditors and early identification of deficiencies are critical for management to appropriately respond to the finding and determine if a mitigating control exists. Early identification allows management time to attempt to remediate the deficiency or put other compensating controls in place.
Can management incorporate a response into the internal control letter?
Absolutely! Assuming management agrees with the deficiency, they are usually given the opportunity to explain their “side of the story” and to provide their remediation plan. Management should focus on the opportunity to improve operations and controls and should work with their advisors to structure a meaningful response that will convey a sense of continuous improvement and betterment.
Can DHG help us?
Yes! The best way is to ask for help early to avoid the deficiency altogether. However, if the deficiency already exists, a third-party consultant can assist with documenting processes, testing controls independently prior to the external auditor’s testing, and can then share additional experiences and best practices on the mitigation of deficiencies. Consultants can also be involved in discussing internal control matters with those charged with governance and lenders, if appropriate, to add perspective to the findings.
For more questions about internal control deficiencies, or to speak with a third-party consultant, contact us at firstname.lastname@example.org.