So the Organization Received an Internal Control Letter - Now What?
If you are part of organization that is audited or have been involved in audits with a prior organization, you understand that audits can cause a significant amount of stress and anxiety. This is especially true when the audit results in adjustments or other deficiencies identified and an internal control deficiency letter is issued to those charged with governance.
What is the purpose of the letter? Auditors are required by professional standards to report, in writing, internal control matters that they believe should be brought to the attention of those charged with governance (often the finance/audit committee). Generally, if an auditor is going to put an internal control matter in a letter, they have determined that the matter was the result of a deficiency in internal controls. This is an important part of an audit that the profession does not take lightly. In addition, auditors spend a lot of time assessing how material audit adjustments and immaterial adjustments should be communicated in an internal control letter. Even if there are no adjustments identified during the audit, a letter could be issued in the event that there are recommendations the auditors would like to make which may include enhancing internal controls, additional training for employees, system improvements or even matters over governance.
As noted above, internal control letters are the result of a deficiency in internal controls discovered during the audit, most commonly from a material audit adjustment. These letters include required language regarding the severity of the deficiency. Depending on materiality and other qualitative factors, the auditors will consider the deficiency to be a material weakness, significant deficiency or “other” matter. The auditors have discretion on which category the deficiency falls into, but are otherwise required to use the standard wording and definitions as stated in the letter.
Prior to drafting an internal control letter, findings and deficiencies detected as a result of audit procedures and issues of general concern should be communicated to management to verify that there is an accurate assessment of the facts. Upon confirming the understanding of the facts, the results are then communicated in draft form for review by management.
So the organization received an internal control letter. Now what? These letters are not the end of the world. The main purpose of these letters is to make note of areas that need to be addressed. They are not meant to be punitive.
Below are some ways to work through an internal control letter and make the experience a little less stressful.
Deficiency Identified: As part of the audit internal control letter, the auditors will identify what the deficiency was and issue a recommendation. Ask them about their assessment of the issue and ask them to provide meaningful and tangible recommendations. There is nothing worse than receiving an internal control letter that does not provide a meaningful recommendation on how to resolve the issue in the future. Management may also have its own recommendation on how to address the issue because of his/her past experience and valuable insight into the operations of the organization.
Early Communication: Be sure to discuss any material audit adjustments or recommendations with the auditor as soon as they are identified. If both parties are in agreement, it is time to bring the matter to the attention of those charged with governance. This early communication helps committee members understand that 1) the root of the deficiency has been identified 2) tangible recommendations have been made and 3) management is proactively working on the issue. Committee members appreciate this early communication as it gives them the opportunity to provide some insight that they may have on the topic. Further, it prevents any surprises when the board receives the final letter and audited financial statements.
Response: This is management’s chance to provide some additional context on the issue and the steps that have been taken or will be taken to address the deficiency. To a committee member, this may be the most important part of the letter. If a deficiency has been identified, committee members want to know that management is going to address the issue. Seeing new internal controls put in place or active steps towards addressing the issue provides greater comfort that controls have been improved and the recommendation was taken seriously.
Next Year: Management now has the opportunity to prevent any deficiency or material adjustment identified from occurring the following year. Take the recommendation and implement management’s response. Since the auditor will be looking at whether the recommendation was implemented during the following year’s audit, be sure to communicate with them early on what controls were put in place to address the issue.
Nobody likes to receive an internal control letter, but remember the purpose of the letter is to improve the organization’s internal control. It may also result in increased efficiencies and open doors to new ideas. If management communicates early and follows through on the recommendations, all stakeholders of the organization will feel better about the audit results.
Maxine Romano can be reached at 215-441-4600, or Email.