1844 The Standards of Field Work
that pertain to the entity's objective of reliable financial reporting. In this sec-
tion, the term financial reporting relates to the preparation of reliable financial
statements that are fairly presented in conformity with generally accepted ac-
counting principles (GAAP).
2
The design and formality of an entity's internal
control will vary depending on the entity's size, the industry in which it oper-
ates, its culture, and management's philosophy.
.04 In an audit of financial statements, the auditor is not required to per-
form procedures to identify deficiencies in internal control
3,4
or to express an
opinion on the effectiveness of the entity's internal control. However, during
the course of an audit, the auditor may become aware of deficiencies in internal
control while obtaining an understanding of the entity and its environment, in-
cluding its internal control, assessing the risks of material misstatement of the
financial statements due to error or fraud, performing further audit procedures
to respond to assessed risks, communicating with management or others (for
example, internal auditors or governmental authorities), or otherwise. The au-
ditor's awareness of deficiencies in internal control varies with each audit and
is influenced by the nature, timing, and extent of audit procedures performed,
as well as other factors.
Definitions
.05 A deficiency in internal control exists when the design or operation of
a control does not allow management or employees, in the normal course of
performing their assigned functions, to prevent, or detect and correct misstate-
ments on a timely basis.
A deficiency in design exists when
•
a control necessary to meet the control objective is missing; or
•
an existing control is not properly designed so that, even if the control
operates as designed, the control objective would not be met.
A deficiency in operation exists when
•
a properly designed control does not operate as designed; or
•
the person performing the control does not possess the necessary au-
thority or competence to perform the control effectively.
.06 A material weakness is a deficiency, or combination of deficiencies, in
internal control, such that there is a reasonable possibility
5
that a material
misstatement of the entity's financial statements will not be prevented, or de-
tected and corrected on a timely basis.
.07 A significant deficiency is a deficiency, or a combination of deficiencies,
in internal control that is less severe than a material weakness, yet important
enough to merit attention by those charged with governance.
2
Reference to generally accepted accounting principles includes, where applicable, a comprehen-
sive basis of accounting other than generally accepted accounting principles, as that term is defined
in paragraph .04 of section 623, Special Reports, as amended.
3
Hereinafter in this section, the term internal control means internal control over financial
reporting.
4
Section 314, Understanding the Entity and its Environment and Assessing the Risks of Material
Misstatement, contains a detailed discussion of internal control and identifies the following five inter-
related components of internal control: (a) the control environment, (b) the entity's risk assessment,
(c) information and communication systems, (d) control activities, and (e) monitoring.
5
In this section, a reasonable possibility exists when the likelihood of the event is either reason-
ably possible or probable as those terms are defined in the Financial Accounting Standards Board Ac-
counting Standards Codification glossary. [Footnote revised, June 2009, to reflect conforming changes
necessary due to the issuance of FASB ASC.]
AU §325.04