Red River TASBO Internal Control as it Relates to the School District Audit

1. 1 Red River TASBO Internal Control as it Relates to the School District Audit Presented by: Michael D. Edgin, CPA Edgin, Parkman, Fleming & Fleming, PC

2. 2 Overview We are going to review: History of the Auditor�s role regarding internal control Changes to that role relative to the Statement on Auditing Standards

3. 3 Historically Speaking Obviously, Auditors have dealt with internal control for years. However, there may be a misconception of the Auditor�s actual role. Historically, we will look at: Government Auditing Standards (GAS) Single Audit Act

4. 4 Government Auditing Standards (GAS) Management is responsible for establishing and maintaining effective internal controls over financial reporting. The Auditor must consider internal control over financial reporting. The consideration is for planning and performing the audit only. The consideration is not for expressing an opinion on the effectiveness of the internal control.

5. 5 Government Auditing Standards (GAS) The Auditor will not necessarily identify all deficiencies in internal control. The Auditor is required to report reportable conditions (now significant deficiencies) and material weaknesses that come to their attention only.

6. 6 Single Audit A Single Audit is required if an entity expends $500,000 or more in a fiscal year in federal programs � not every school district is required to have a Single Audit. Management is responsible for establishing and maintaining effective internal controls over compliance with the requirements of laws, regulations, contracts, and grants applicable to federal programs. The Auditor�s focus is only on those grants being tested (the major programs).

7. 7 Single Audit (Cont�d) The Auditor is only required to test those areas that could have a direct and material effect on the major federal programs being tested. The tests of internal control are made only to determine the Auditor�s audit procedures for expressing an opinion of compliance only (not on internal controls). No opinion is expressed on the effectiveness of internal control on compliance.

8. 8 Summary The Auditor is not required to test internal controls over financial reporting in a GAS audit. In the past, most Auditors considered the audit risk at maximum and just performed substantive tests. Only in a Single Audit was it required to test internal controls, but it was limited to compliance with major federal programs. However, it is up to the Auditor�s professional judgment on what to test or not. However, in all cases the Auditor does not express an opinion on the internal controls of the District. However, if the Auditor discovers a weakness in internal control, the firm must report it.

9. 9 Changes to the Auditing Standards Effective in fiscal year ended August 31, 2007 and 2008, there are new Statements on Auditing Standards (SAS) that dramatically impact the audit as follows: SAS No. 112 SAS Nos. 104-111 SAS No. 114

10. 10 SAS No. 112 This new SAS titled �Communicating Internal Control Related Matters Identified in an Audit� was effective for the 2006-07 audits. It changed the wording and definitions previously used. Reportable Conditions changed to Significant Deficiencies. The terminology for Material Weakness did not change, only the definition.

11. 11 SAS No. 112 (Cont�d) However, the definitions of each changed lowering the thresholds making lesser items significant deficiencies and material weaknesses. For example, if a material audit adjustment is made, by definition, this has to be reported as a material weakness in internal control over financial reporting. This was mostly a communication requirement. It did not change the audit approach or process.

12. 12 Risk Assessment Standards The new SAS Nos. 104 to 111 are collectively called the Risk Assessment Standards. They are effective for the 2007-08 audits. In summary, they require the Auditor to evaluate and perform audit procedures where there is more audit risk. Consequently, there is more emphasis on the planning process and the District�s internal control. The better the entity�s internal control, the less risk, and visa-versa. The Auditor is still not expressing an opinion on internal control over financial reporting under GAS or internal control over compliance in a Single Audit.

13. 13 Risk Assessment Standards (Cont�d) However, the Auditor will focus more on internal control and perform additional procedures compared to the prior year. The most notable procedure required is called a �walk-through�. Walk-throughs are required for each major transaction cycle. The Auditor will select an actual transaction and walk it through the accounting process to ensure the entity is doing what it says it is doing. For example, if a District�s policy is to vouch the quantities received to the quantities invoiced by the vendor, then the Auditor should be able to see the documentation of the procedure in the accounting records.

14. 14 Risk Assessment Standards (Cont�d) Consequently, the Auditor will spend more time in the audit planning phase getting more specifics on the procedures in place and testing them through the walk throughs. What could happen this year is more findings relative to internal control since more procedures are being performed.

15. 15 SAS No. 114 This Auditing Standard is labeled �The Auditor�s Communication with Those Charged with Governance�. It is effective for the 2007-08 audits. For school districts, those charged with governance would be the District�s Board of Trustees. Its goal is to create a better working relationship between the Auditor and the Board of Trustees. It requires the communication of the following: Auditor�s responsibilities under generally accepted auditing standards, Overview of the planned scope and timing of the audit, and Significant findings from the audit.

16. 16 SAS No. 114 (Cont�d) Significant findings from the audit include: Significant difficulties encountered during the audit. Uncorrected misstatements. Disagreements with management. Other findings on issues arising from the audit that are, in the professional judgment of the Auditor, significant and relevant to the Board of Trustees regarding their oversight of the financial reporting process.

17. 17 SAS No. 114 (Cont�d) What all of this means is that some things that have historically only been discussed with District management will be required to be communicated to the Board of Trustees in writing. EPFF actually implemented this SAS last year to coincide with SAS 112.

18. 18 Summary There are no new requirements to express an opinion on internal control. However, the Auditor will be spending more time understanding and possibly testing internal control. More findings and/or comments may result from the increased procedures. In my opinion, internal control is a process, and changes from time-to-time. That is why we performed interim audit procedures on all of our audits last year. If something surfaced at interim, we encouraged action to be taken by year-end to avoid any findings, significant deficiencies, and/or material weaknesses.

19. 19 What Can Your District Do? Review the District�s procedures manual and determine if you are really doing what your documentation states. If your procedures are not in writing, consider doing so. Therefore, regardless of personnel changes, training, etc., there is a single resource that clearly documents what should be done. Make sure the procedures performed are clearly documented for a third party to see. If your auditor does not perform interim audit procedures at your district, you may consider it. It will help identify any potential concerns so actions can be taken to correct them prior to the year-end audit procedures.

20. 20 Questions? Thank you!!