Implications of SAS 112

1
Implications of SAS 112

• NCURA Regional Meeting
• Park City, Utah
• April 22-27, 2006

2
Agenda

• What is SAS 112?
• Implications for A133 Audit
• Examples of Key Controls
• How Campuses Can Prepare
• Q A

3
What is SAS112?

• Statement of Auditing Standards that applies to
  not-for-profit entities
• Designed to make the standards used for audit of
  not-for-profits consistent with those already in
  place for public companies
• Effective Date For years ending on or after
  December 15, 2006

4
Purpose of SAS 112

• To establish a standard for determining
  seriousness of a control issue and classifying it
  into one of three categories
• control deficiency
• significant deficiency
• material weakness
• To ensure effectiveness of internal controls that
  impact financial statements

5
SAS 112 Deficiencies

• A control deficiency exists when the design or
  operation of a control does not allow management
  or employees, in the normal course of performing
  their assigned functions, to prevent or detect
  misstatements on a timely basis.
• A significant deficiency is a control deficiency,
  or combination of control deficiencies
• A material weakness is a significant deficiency,
  or a combination of significant deficiencies

6
SAS DeficienciesIllustrative Quantifications
(Source PwC)
Classification of Deficiency Likelihood of With Potential Magnitude of Misstatement
Control Deficiency Remote Less than a 5 to 10 Chance Inconsequential Less than a 0.1 to 0.2 or revenues or expenses
Significant Deficiency More than remote More than a 5 to 10 chance More than inconsequential Greater than 0.1 to 0.2 of revenues or expenses
Material Weakness More than remote More than a 5 to 10 chance Material Greater than 1.0 of revenues or expenses
The levels of magnitude are still under
discussion and may be revised as practice evolves.
7
Implications for A133 Audit

• The GAO has adopted same definitions of control
  weaknesses in Yellow Book
• For key controls testing
• an error rate of 1 in 50 is OK
• an error rate of 2 in 50 fails
• Note Error control failure not necessarily an
  accounting error
• Expectation is that there will be more
  significant deficiencies and material weaknesses
  than in the past.

8
How Campuses Can Prepare

• Controllers Office
• Interpret University Policies and Procedures and
  Regulations and Promote Best Practices
• Act as a liaison between external auditors and
  departments
• Agree upon key controls with external auditors
• Provide guidance, key controls framework, and
  communication for SAS-112 implementation to
  departments

9
How Campuses Can Prepare (cont)

• Departments
• Identify and document applicable significant key
  controls in specific area(s)
• Implement key controls
• Document evidence of review for all levels when
  performed (signature and/or email)
• Perform self-assessment and test key controls to
  ensure the key controls are in place
• Document evidence of review
• Fix SAS 112 deficiencies when identified
• Document evidence of corrective action taken

10
Q A