Catherine Allen et al.'s article ("Navigating the Crossroads of Control and Independence ," Dec. 07, page 42) was an excellent article clarifying the guidance in Statement on Auditing Standards (SAS) no. 112 as it applies to private company auditors' responsibilities of communicating internal control matters. Page 46 of the article provided an example of a client failing to detect an error that the practitioner identified as a significant deficiency in internal control over financial reporting that "would have caused a misstatement in the financial statements."
While the article did not elaborate if the misstatement was material to the financial statements, if a material misstatement would have been reflected in the financial statements due to a deficiency in the internal control over financial reporting (for example, was not detected or prevented by the client's internal controls), it may rise above the level of a significant deficiency and be a material weakness.
SAS no. 112, Communicating Internal Control Related Matters Identified in an Audit, states that, "a material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected..."
Additionally, PCAOB Auditing Standard no. 5 states a similar definition for material weaknesses detected during integrated audits for public companies.
The evaluation and assessment of internal control deficiencies is highly dependent on auditor judgment and other engagement-specific factors, in addition to quantitative materiality thresholds. Auditors should apply their own professional judgment when aggregating and concluding on internal control deficiencies.
This article did a good job of providing an overview of the new responsibilities that auditors have when conducting audits of private companies. Communication of these new auditing requirements with clients is a key aspect of the practitioner's job to properly educate their private company clients as to the potential implications of the new internal control communication requirements and the auditor's responsibilities under Generally Accepted Auditing Standards. The new standards can also provide practitioners opportunities to serve their clients as trusted business advisers with regard to their private company clients' internal controls over financial reporting.
Matthew R. Johnson, CPA