Auditors should be asking more questions about internal controls, checks and balances, the control environment, and policies and procedures. Originally issued statement on auditing standards, SAS 109 Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement and SAS 115 Communicating Internal Control Related Matters in an Audit have a direct impact on local governments. These standards have subsequently been codified into SAS 122 and are found under AU-C sec. 315 and AU-C sec. 265.

AU-C sec. 315 requires that auditors gain a more thorough understanding of the government’s environment, including internal control. This standard defines internal control as:

“A process affected by those charged with governance, management, and other personnel designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations."

AU-C sec. 265 requires the auditors to communicate internal control deficiencies documented during the audit process. Municipalities may have more audit findings in their reports than in prior years. This may not mean you are handling transactions differently than in the past but auditors may not have asked the detailed level of questions that are now required in order to document compliance with these standards. Audit findings in the past that were referred to as “reportable conditions” are now called “significant deficiencies.” The term “material weakness” remains the same. Local governments that have not adopted control procedures to ensure financial transactions are processed accurately and completely will see “significant deficiencies” or “materials weaknesses” in their audit reports.

The standard also requires certain communications related to significant deficiencies and material weaknesses to be made in writing to management and those charged with governance. The person(s) who holds responsibility for strategic oversight for the direction of the entity and obligations for the accountability of the entity are considered “those charged with governance.” In local governments, that is usually the board of mayor and aldermen, council or commission. Management and elected officials should expect to see and hear more communications before, during and after the audit.

A few examples of control deficiencies found in government auditing guidance that might be the basis for an audit finding include:

• Lack of awareness of the importance of controls by top management (elected officials, mayor, city manager or administrator)
  • Failure to ensure that policies and procedures are adopted
• Ineffective oversight by those charged with governance
  • Failure to hire competent personnel in key management positions
• Control systems (check and balances) are not adopted or are not working properly
• Identification of fraud
• Failure by management to correct previously communicated deficiencies