SAS 104-111 for Nonprofit Execs

What can the nonprofits do to be prepared for the
new standards in order
to avoid problems, conflicts, and/or excessive fees.

Maryland Nonprofits
June 4, 2008

Answer – (Steps to a simpler
audit)

Develop and document your controls
Set up regular tests of controls
Educate and involve your board
Establish a control environment
Remove risk factors
Follow your own rules

2 www.metrometro.com

I’m up to my *&?! In SASs

104 “Due Professional Care” Effective Dates:
105 Amendment to SAS 95, GAAS 104-111 Effective for audits of
F/S for periods beginning on
106 Audit Evidence
or after 12-15-06.
107 Audit Risk and Materiality
108 Planning and Supervision
109 Understanding the Entity and its environment and
assessing the risks of Material Misstatement
110 Performing Audit Procedures in response to assessed
risks and evaluating the audit evidence obtained
111 Amendment to SAS 39, Audit Sampling


Why so much focus on risk
assessment?

A 2006 Certified Fraud Examiners survey
revealed the median size of reported fraud in
entities of less than 100 employees is
$190,000. How many businesses of that size
can withstand losing that amount of money
and survive?


Format of 60 minutes

Brief background, really brief
Process of documenting controls
A developer’s view (if we have time)


COSO Framework – Components of
Internal Controls

Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring

None of these are static; continuing
process

Differences – Old Standards

Identify the classes of transactions and
where the control risks were highest.
Understand the accounting transactions
within those classes
Understand the errors that may exist
Develop programs to find those errors


New Standards

Gain a more thorough understanding of the client’s
business and operations to evaluate the internal
controls’ design and effectiveness
Evaluate controls throughout the audit engagement,
looking back at the planning to see if it needs to be
changed
Evaluation of internal controls must meet the same
“audit evidence” requirement as other parts of the
audit


Areas of Interest

Cash
Support and Receivables
Donated Materials, Services, Facilities
Accounts Payable and Purchasing
Inventory
Payroll
Debt


How Do We Develop Our Controls?

How could a misstatement occur?
What can be done to prevent it?
Who should perform the steps?
Who shouldn’t perform the steps
How could fraud occur?
What can be done to prevent it?


Cash Controls

Delinquent accounts receivable are reviewed.
Cash receipts are reconciled to general
ledger postings daily.
Adjustments of cash accounts are approved
by the appropriate level of management or
another appropriate person.
Bank reconciliations are prepared and
reviewed in a timely fashion.


Individuals who post cash receipts to the
accounts receivable subledger cannot:

Review the accounts receivable aging trial balance.
Authorize write-offs of delinquent accounts.
Independently investigate accounts receivable discrepancies.
Maintain or authorize accounts receivable adjustments.
Edit the accounts receivable master file.
Process customer service calls and complaints.
Investigate discrepancies or issues related to revenue.
Open the mail or copy checks received.
Prepare deposits.
Deposit cash receipts.
Reconcile bank accounts.


Cash receipts from special events are
counted by at least two people.

Cash Receipts Count Sheet
Event –
Date –
Counter 1 Name______________Result_____
Counter 2 Name______________Result_____

(Counters should count and report separately)

Worksheet completed by__________


Simple, but good enough?

Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring


Payroll Controls

Individuals who initiate payroll checks cannot:
Prepare payroll checks.
–
Sign payroll checks.
–
Review and authorize electronic payroll
–
disbursements.
Disburse payroll checks.
–
Control unclaimed paychecks.
–
Resolve employee payroll inquiries.
–
Edit the payroll master file.
–


More Payroll Controls

Individuals who prepare payroll checks cannot:
Sign payroll checks.
–
Review and authorize electronic payroll disbursements.
–
Disburse payroll checks.
–
Control unclaimed paychecks.
–
Resolve employee payroll inquiries.
–
Edit the payroll master file.
–
Open mail or copy checks received.
–


Keep Going Through All the Rest of
The Controls

We’ll give you the test before you take it


Sonal, I’d love to add some additional
controls here and define detective and
?? Controls.


Testing Controls – Here’s what we do

Describe the procedure(s) performed to obtain audit evidence
that the control(s) is (are) operating effectively, or cross-
reference to a related workpaper that documents the testing
procedures. If sampling is performed, document the items
selected for testing. If deviations are detected, perform and
document inquiries to understand the cause of the deviations
and their potential consequences. For controls that are not
operating effectively, consider whether an internal control
deficiency exists that should be accumulated and evaluated
using , “Control Deficiency Evaluation and Aggregation
Worksheet.”


Fraud Risk Factors (Antenna Up)

Incentives/Pressures
Competition, reduction of grants/funding, pressure on
–
management
Opportunities to Misstate Financials
Related party transactions
–
Lots of cash
–
Ineffective monitoring of management
–

Attitudes/Rationalizations
Management doesn’t support values of organization
–
(top down)


Who’s Job is it?

Develop and document internal controls?
Test controls to make sure they are working
properly?
Evaluate high risk control areas?


SAS 110

SAS No. 110, Performing Procedures (continued)
Test of Controls may be rotated
– The auditor should test the operating effectiveness of
controls at least every three years in an annual audit
– The auditor should update his or her understanding to
ensure controls have not changed
– If the auditor plans to rely on control that have changed,
the auditor should test the controls


“Have To’s” (Fast, Fast, Fast)

The auditor must plan and perform the audit
to obtain sufficient appropriate audit
evidence so that audit risk will be limited to a
low level that is, in his or her professional
judgment, appropriate for expressing an
opinion on the financial statements. (SAS
104)


Have To

The audit must be performed by a person or
persons having adequate technical training
and proficiency as an auditor. (SAS 105)


Have To

The auditor must adequately plan the work
and must properly supervise any assistants.
(SAS 105 and SAS 108)


Have To

The auditor must obtain a sufficient
understanding of the entity and its
environment, including its internal control, to
assess the risk of material misstatement of
the financial statements whether due to error
or fraud, and to design the nature, timing,
and extent of further audit procedures. (SAS
105 and SAS 109)


Have To

The auditor must perform risk assessment
procedures to provide a satisfactory basis for
the assessment of risks at the financial
statement and relevant assertion levels.
(SAS 106)


Have To

The auditor must supplement the risk
assessment procedures by further audit
procedures in the form of tests of controls,
when relevant or necessary, and substantive
procedures. (SAS 106)


Have To

The auditor must consider audit risk and must
determine a materiality level for the financial
statements taken as a whole for the purpose of:
Determining the extent and nature of risk assessment
–
procedures
Identifying and assessing the risks of material misstatement
–
Determining the nature, timing, and extent of further audit
–
procedures
Evaluating whether the financial statements taken as a
–
whole are presented fairly, in all material respects, in
conformity with generally accepted accounting principles
(SAS 107)


Have To

The auditor must plan the audit so that it is
responsive to the assessment of the risk of
material misstatement based on the auditor’s
understanding of the entity and its
environment, including its internal control.
(SAS 108)


Have To

The auditor must develop an audit plan in
which the auditor documents the audit
procedures to be used that, when performed,
are expected to reduce audit risk to an
acceptably low level. (SAS 109)


Have To

The auditor must obtain sufficient appropriate
audit evidence by performing audit
procedures to afford a reasonable basis for
an opinion on the financial statements. (SAS
105, SAS 106, and SAS 110)


Have To

The auditor must perform the audit to obtain
reasonable assurance of detecting
misstatements that the auditor believes could
be large enough, individually or in the
aggregate, to be quantitatively material to the
financial statements. (SAS 107)


Have To

The auditor must not be satisfied with audit
evidence that is less than persuasive. (SAS
106)


Have To

The auditor must accumulate all known and
likely misstatements identified during the
audit, other than those that the auditor
believes are trivial, and communicate them to
the appropriate level of management. (SAS
107)


Have To

The auditor must consider the effects, both
individually and in the aggregate, of
misstatements (known and likely) that are not
corrected by the entity. (SAS 107)


Have To

The auditor must evaluate whether the
financial statements taken as a whole are
free of material misstatement. (SAS 107)


Anything for the Nonprofit So Far?

I think EVERYTHING!

You’ve got to continually monitor and change
your controls as your organization and it’s
personnel change.


What should you take away from this
seminar?

Develop and document your controls
Test them regularly because we will. Don’t let
us find non-functioning controls
Less nonroutine transactions
The audit will take longer if you are not
prepared. You need to spend a few bucks
on getting your systems developed,
documented and functioning


What should you do?

Involve the board in internal audit functions.
Prepare a checklist of internal audit
procedures that must be completed each
month, assign a board member a month


Monthly Internal Audit Sample
Procedures

Open bank statement and review for proper
signatures, proper endorsement,
recognizable payee
Compare revenue per financial statement to
deposits per bank statement and reconcile
Select 3 employees from payroll journal and
compare to employee file authorized pay rate
Report to the board monthly (dashboard)


Dashboard Report


Resource to Develop Controls

Controldocs
Controldocs lite

www.cobre.com
cpa2biz.com


Make your audit easier

7 Tips


Take Control - Make Your Audit Easier

Make less journal entries - Audit standards
require that we review journal entries for
unusual activities. The more entries, the
longer the audit takes. You can cut down on
journal entries by recording bank charges,
debits and manual checks as you would any
other cash disbursement. Record bank
account interest earned like you would a
deposit.



Be ready for us - Make sure your auditor
has provided you with a long Client
Assistance List (CAL) or PBC (Provided by
Client) list. The longer the better so that you
can do the work at your schedule instead of
scurrying during the audit fieldwork. Number
the list and have a folder, notebook tab, or
pile for each number. Impress the auditor,
be organized, that's what we're looking for.



Be consistent and predictable - We like ordinary
and boring. If you have a group of month end
journal entries for depreciation, accrued payroll, etc.,
make them all on one entry that looks the same each
month. Keep entries as ordinary and routine as
possible. Record deposits the same. Record
invoices the same. Make the transactions as easily
identifiable as possible.



Support, Support, Support - Every
transaction requires support. Checks,
deposits, journal entries. Be consistent by
including the same support on each type of
transaction. Make sure every transaction
has the required approvals.



Document your approval processes and
follow them - If a disbursement requires a
board signature, make sure it has a board
signature. Make sure your approval
processes will pass the auditor's tests.



Don't turn the audit engagement into an
accounting engagement. Get the accounting work
done first. Post accruals, depreciation, make sure
everything ties in, etc. We don't want to do
accounting work at the audit. Auditors like to tick
and tie to get comfort that the numbers are
right. Every time we have to make an entry, you lose
credibility and it takes longer for us to get
comfortable. Your auditors don't have to be your
accountants, you can hire an accountant to do a
monthly or quarterly review so that you'll be more
prepared for your audit.



Insist on consistency from your audit
team. Ask ahead of time, who will be
coming. Are they the same auditors as last
year? If not, push back a little bit. The more
consistency, the less learning curve and the
less interruptions.


Guidance for the nonprofit

Graham has a book coming out, Internal
Controls: Guidance for Private, Government
and Nonprofit Entities, which helps
companies understand how to document
their controls and helps to bridge the auditor-
client issues in controls assessment and
testing.


Risk Assessment Standards

To gain some insight on the need for, and
utilization of, these standards, California CPA
recently interviewed CPA Lynford Graham,
Ph.D., CFE.


Lynford Graham, Ph.D CPA, CFE

As a former member of the AICPA's Auditing Standards
Board and Risk Assessment Standards Task Force,
and chair of the Risk Assessment and Risk
Response Audit Guide Task Force, Graham was
instrumental in developing these Audit Risk
Standards. A frequent lecturer on the subject
nationwide, Graham also is the author of a handbook
on documenting internal controls for non-public
companies.


Question

What were the goals and objectives
of the ASB and Risk Assessment
Standards Task Force?


Answer

A: The ASB, in coordination with the International Audit
and Attest Standards Board, undertook a joint
project in the latter 1990s to clarify many of the core
auditing standards and advance more guidance on
the role and performance of risk assessment. This
was in response to concerns that audits were
becoming increasingly risk-based, but there was a
lack of guidance on how to go about the risk
assessment process.


Answer (cont)

There were also concerns that, in some cases,
too little audit work was being done to
identify and correct any errors that might
exist in the pre-audit financial statement
records.

Graham


Answer (cont)

Auditors of major entities were becoming more
reliant on the seemingly improved and
automated systems, and internal audit
resources of these entities.

Graham


Why Now?

The disastrous events and audit failures in early 2000
that lead to the Sarbanes-Oxley Act of 2002 are
evidence that the project was on target, but that it
was too late to avoid the events of Enron, WorldCom
and the litany of business and audit failures in that
time period.

Graham


Q: How revolutionary are these
standards?

A: Tough question. Much of the answer
depends on what you have been doing in
your audits all along.

Graham


Answer (cont) How revolutionary are
these standards?

The standards mostly clarify the intent of existing
standards. Many firms have been successfully using
the concepts in these new standards for a long time.
For example, using audit assertions as an integral
part of the audit planning and performance of the
audit is not new. Neither is the assessment of
controls as part of understanding the audited entity.
That requirement extends to before SAS No. 55.

Graham


Answer (cont) How revolutionary are
these standards?

There are only a few quot;newquot; concepts, such as the
identification of quot;significant risksquot; for audit
engagements, which was not part of the auditing
literature before, but were still practices of some
firms before SAS No. 109. In any case, the extent of
change these standards will bring will differ from firm
to firm.

Graham


Where are firms struggling with
implementation?

A: The requirement to assess internal controls
design and implementation for audit clients
seems to be giving some firms consternation.
While not a new concept, this assessment
was often glossed over for smaller client
audits where controls reliance was not
planned


implementation?

Clarifying this requirement creates a need for
broad understanding of the COSO
framework and its components, how control
objectives or attributes are used to assess
controls design, and how to identify any
obvious quot;holesquot; in the internal controls of an
entity.


implementation?

Concerns are out there that this is a Sarbanes
approach, which it is not. SAS No. 78 put the
COSO framework clearly in our literature
long ago, before SOX. The quot;suitequot;
requirement is only to assess the design of
controls and there is no requirement to test
them.


implementation?

In addition, the controls requirements can be
limited to the most significant control activity
processes, like sales, major cost processes
and payroll, and maybe the consolidation
and closing process. SOX requirements are
much more extensive and require controls
testing.


implementation?

Reporting material weaknesses and significant
deficiencies in controls, in writing, to the governance
group is also an area of attention and concern. While
not officially in the suite, SAS No. 112,
Communicating Internal Control Related Matters
Identified in an Audit, works with SAS No. 109 to
ensure internal control matters are identified and
communicated.


Additional Parts of Graham Interview

audits of smaller entities are not supposed to
be a second-class service compared with
audits of larger entities. By clarifying the
standards, all firms will compete on an equal
footing, and not by re-defining what
constitutes an audit under Generally
Accepted Auditing Standards.


Why so much focus on risk
assessment?

A 2006 Certified Fraud Examiners survey
revealed the median size of reported fraud in
entities of less than 100 employees is
$190,000. How many businesses of that size
can withstand losing that amount of money
and survive?


Guidance for the nonprofit

Graham has a book coming out, Internal
Controls: Guidance for Private, Government
and Nonprofit Entities, which helps
companies understand how to document
their controls and helps to bridge the auditor-
client issues in controls assessment and
testing.


What do CPAs need to understand
most clearly about the standards?

Many of the new requirements will require a
real first-year effort to get up and running.
The maintenance in year two, and beyond, of
well-implemented changes will not be that
hard or expensive.

Graham


SAS 104-111 for Nonprofit Execs

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Viewers also liked

Viewers also liked (7)

Similar to SAS 104-111 for Nonprofit Execs

Similar to SAS 104-111 for Nonprofit Execs (20)

Recently uploaded

Recently uploaded (20)

SAS 104-111 for Nonprofit Execs