Reporting on Internal Financial Controls- Application of SA 265

Reporting on Internal Financial Controls under Clause (i) of Subsection 143(3) of the Companies Act, 2013- Application of principles of SA 265

1. The auditor during the course of his audit may become aware of various matters of concern including deficiencies in internal control in the auditee which may be identified during the risk assessment stage or any other stage of the audit. These are normally evaluated and communicated to the appropriate level in the organisation orally or in writing. When the auditor is present at the meeting of the Board (nowadays Audit Committee of the Board) for approval of the financial statements he is usually asked about matters he wishes to bring to the attention of the Board. At such time he brings up such matters which in his opinion require the attention of the Board not necessarily limited to the financial statements. Under the standards of auditing the auditor is required to communicate significant deficiencies in internal control to those charged with Governance including the management in writing in a timely manner. The illustrative format of the engagement letter contained in SA 210 includes a commitment to communicate such significant deficiencies from the auditor. The Standard on Auditing, SA265 Communicating Deficiencies in Internal Control to Those charged with Governance, provides guidance in discharging this responsibility to the auditor. Therefore reporting on significant deficiencies found during the course of the audit is expected of the auditor even though he has not audited the internal controls with a view of expressing a view on their adequacy or effectiveness. The SA also provides guidance on how to deal with other internal control deficiencies not considered significant. Communicating significant deficiencies in a timely manner will alert management and those charged with governance to initiate remedial action.

2. Pending issue of a suitable guidance from ICAI the principles contained in this SA discussed in the ensuing paragraphs can be used by the auditor to discharge his reporting responsibility under clause(i) of Subsection 143(3) of the Companies Act,2013 where he has to report on whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls.

3. SA 265 defines “deficiencies in internal control” and “significant deficiencies in internal control” as under:

(a) Deficiency in internal control – This exists when:

(i) A control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or

(ii) A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing.

(b) Significant deficiency in internal control – A deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance.

4. The auditor at the end of the audit has to determine whether he has encountered deficiencies in internal control and then evaluate whether these deficiencies or a combination of these deficiencies could be considered significant. SA 265 gives some indicators to help the auditor in determining whether the deficiency observed is significant. These are contained in Application Guidelines A5 to A8:

“A5. The significance of a deficiency or a combination of deficiencies in internal control depends not only on whether a misstatement has actually occurred, but also on the likelihood that a misstatement could occur and the potential magnitude of the misstatement. Significant deficiencies may therefore exist even though the auditor has not identified misstatements during the audit.

A6. Examples of matters that the auditor may consider in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:

● The likelihood of the deficiencies leading to material misstatements in the financial statements in the future.

● The susceptibility to loss or fraud of the related asset or liability.

● The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates.

● The financial statement amounts exposed to the deficiencies.

● The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to the deficiency or deficiencies.

● The importance of the controls to the financial reporting process; for example:

o General monitoring controls (such as oversight of management).

o Controls over the prevention and detection of fraud.

o Controls over the selection and application of significant accounting policies.

o Controls over significant transactions with related parties.

o Controls over significant transactions outside the entity’s normal course of business.

o Controls over the period-end financial reporting process (such as controls over non-recurring journal entries).

● The cause and frequency of the exceptions detected as a result of the deficiencies in the controls.

● The interaction of the deficiency with other deficiencies in internal control.

A7. Indicators of significant deficiencies in internal control include, for example:

● Evidence of ineffective aspects of the control environment, such as:

o Indications that significant transactions in which management is financially interested are not being appropriately scrutinised by those charged with governance.

o Identification of management fraud, whether or not material, that was not prevented by the entity’s internal control.

o Management’s failure to implement appropriate remedial action on significant deficiencies previously communicated.

● Absence of a risk assessment process within the entity where such a process would ordinarily be expected to have been established.

● Evidence of an ineffective entity risk assessment process, such as management’s failure to identify a risk of material misstatement that the auditor would expect the entity’s risk assessment process to have identified.

● Evidence of an ineffective response to identified significant risks (e.g., absence of controls over such a risk).

● Misstatements detected by the auditor’s procedures that were not prevented, or detected and corrected, by the entity’s internal control.

● Disclosure of a material misstatement due to error or fraud as prior period items in the current year’s Statement of Profit and Loss7.

● Evidence of management’s inability to oversee the preparation of the financial statements

A8. Controls may be designed to operate individually or in combination to effectively prevent, or detect and correct, misstatements..For example, controls over accounts receivable may consist of both automated and manual controls designed to operate together to prevent, or detect and correct, misstatements in the account balance. A deficiency in internal control on its own may not be sufficiently important to constitute a significant deficiency. However, a combination of deficiencies affecting the same account balance or disclosure, relevant assertion, or component of internal control may increase the risks of misstatement to such an extent as to give rise to a significant deficiency. “

5. Having determined that there is a significant deficiency in the internal control the auditor would require to communicate the same to the appropriate level of the management and those charged with governance. The communication could initial be oral but it has to be followed up with a written communication within a reasonable period of time. The contents of the communication and the level of detail are also a matter of professional judgement. The standard contains guidance on this matter. The standard also clarifies that cost of addressing these significant deficiencies should not be a factor for the auditor to consider and he has to report these significant deficiencies notwithstanding the cost of implementation. Further, deficiencies considered significant and reported in an earlier audit period but not remedied have to be included in the current communication. According to the standard the auditor is required to seek explanation from the management / board as to why the deficiency pointed out in the previous audit has not been remedied, as a failure to act is by itself a significant deficiency.

6. Guidance on the contents of the communication are contained in paragraphs A28 and A29 of the Application section as below :

“A28.In explaining the potential effects of the significant deficiencies, the auditor need not quantify those effects. The significant deficiencies may be grouped together for reporting purposes where it is appropriate to do so. The auditor may also include in the written communication suggestions for remedial action on the deficiencies, management’s actual or proposed responses, and a statement as to whether or not the auditor has undertaken any steps to verify whether management’s responses have been implemented.

A29.The auditor may consider it appropriate to include the following information as additional context for the communication:

● An indication that if the auditor had performed more extensive procedures on internal control, the auditor might have identified more deficiencies to be reported, or concluded that some of the reported deficiencies need not, in fact, have been reported.

● An indication that such communication has been provided for the purposes of those charged with governance, and that it may not be suitable for other purposes.”

The aforesaid guidance is based on the requirement of para 11 of the Standard:

“11. The auditor shall include in the written communication of significant deficiencies in internal control:

(a) A description of the deficiencies and an explanation of their potential effects; and (Ref: Para. A28)

(b) Sufficient information to enable those charged with governance and management to understand the context of the communication. In particular, the auditor shall explain that: (Ref: Para. A29-A30)

(i) The purpose of the audit was for the auditor to express an opinion on the financial statements;

(ii) The audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control; and

(iii) The matters being reported are limited to those deficiencies that the auditor has identified during the audit and that the auditor has concluded are of sufficient importance to merit being reported to those charged with governance.”

7. Clause (i) of Section 143 (3) of the Companies Act requires the auditor to state whether “ the company has adequate internal financial controls system in place and the operating effectiveness of such controls”. As it is made clear in SA 200 that the audit of internal financial controls to express a view on their adequacy and operating effectiveness is outside the scope of an audit of financial statements, an appropriate guidance from ICAI is the need of the hour as the guidance note now issued is in respect of reporting under clause (i) of Section 143(3) based on audit of internal financial controls as a separate assignment.

8. Pending issue of such guidance note by ICAI, the auditor would have to report based on his understanding of the requirement of the clause and communicate his views on the internal control from his audit of the financial statements carried out as per the ICAI standards on auditing. The paper writer’s personal opinion is that through this clause, the auditor has to inform the members whether he has found any deficiencies in the internal financial controls and whether these deficiencies were significant requiring the attention and remedial action of the management. The principles laid down in SA 265 which are set out above can be used to determine whether deficiencies exist and whether these deficiencies are material.

9. Another issue which also requires guidance from ICAI is whether the details of the deficiencies observed are required to be given against this clause. On this issue the paper writer is of the view that unless the significant deficiencies observed have resulted in a modified opinion, the details of the deficiencies should not be disclosed. Reason being that the auditor has not carried out an audit of internal financial controls and therefore the observed deficiency may in fact not be a significant deficiency requiring to be reported. (See the requirements of paragraph 11 of the SA 265 reproduced in paragraph 7 above.)

Secondly the purpose of communicating the deficiency is for management to take remedial action and should not come in the public domain as such weaknesses could be exploited to the disadvantage of the company. However when the financial statements are found to be materially misstated resulting in the auditor giving a modified statement, the related control weakness would be apparent, hence the consideration of discretion while reporting against this clause perhaps may not be there.

10. Three possible scenarios could be considered:

a. The financial statements are not found to be misstated and no deficiencies in internal control were observed or the deficiencies not considered significant hence no communication is made to the management.

b. The opinion on the financial statements is a modified opinion. Material deficiencies are observed and communicated to the management of which only some have resulted in the misstatement on which the auditor has given a modified opinion.

c. The financial statements are not found to be misstated. However significant deficiencies in internal control were observed and communicated to the management.

11. Taking into consideration the above premise and the requirements of SA 265 following could be the formats of the auditor’s statement under clause(i) of Section 143(3):

UNMODIFIED OPINION NO DEFICIENCIES SEEN IN INTERNAL FINANCIAL CONTROLS

During the course of our audit of the financial statements we have observed that the company has internal financial controls and no deficiencies either in the adequacy or effectiveness of a significant nature have been observed in these controls. Our audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control. We have therefore not carried out an audit of internal financial controls with an objective of expressing a view on the adequacy or effectiveness of these controls. Had we performed more extensive procedures on internal control we may have identified deficiencies to be reported.

MODIFIED AUDIT REPORT

Attention is drawn to our observations contained in paragraphs x to y under Basis of Qualification section of our audit report . These indicate significant deficiencies in the internal financial controls within the company.( Elaborate appropriately to the extent necessary) During the course of our audit of the financial statements we have observed other weaknesses in the system of internal financial controls. As required by the auditing standard SA 265 Communicating Deficiencies in Internal control to those charged with Governance the perceived deficiencies in these controls which were considered significant have been duly communicated to the Management and the Audit Committee of the Board/ Board. Our audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control. We have therefore not carried out an audit of internal financial controls with an objective of expressing a view on the adequacy or effectiveness of these controls. Had we performed more extensive procedures on internal control. we may have identified more such deficiencies to be included in our communication or concluded some of the deficiencies need not in fact have been communicated

AUDIT REPORT NOT MODIFIED BUT AUDITOR IS OF THE OPINION THAT INTERNAL FINANCIAL CONTROLS REQUIRE STRENGTHENING IN SOME MATTERS

During the course of our audit of the financial statements we have observed that the company has internal financial controls though some of these controls are in our opinion not adequate or could have been better deployed or monitored to improve their effectiveness. As required by the auditing standard SA 265 Communicating Deficiencies in Internal control to those charged with Governance the perceived deficiencies in these controls which were considered significant have been duly communicated to the Management and the Audit Committee of the Board . Our audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control. We have therefore not carried out an audit of internal financial controls with an objective of expressing a view on the adequacy or effectiveness of these controls. Had we performed more extensive procedures on internal control. we may have identified more such deficiencies to be included in our communication or concluded some of the deficiencies need not in fact have been communicated.

12. There is considerable verbiage in the above illustrations arising out of the need for the auditor to clarify his responsibility in respect of internal controls so that a reader is not under the impression that auditor is giving his impression based on an audit thereof to express an opinion on their adequacy and effectiveness. A guidance note from ICAI is awaited as presently most members of ICAI are of the impression that the Guidance Note on Audit of Internal Financial Controls requires the auditor to audit these controls in order to give his findings under this clause. Better if the requirement of clause(i) of Section 143(3) is replaced by this requirement by a Removal of Difficulties Order from MCA: “Whether the auditor has observed significant deficiencies during the course of his audit and whether they have been communicated to the management on a timely basis”. In such a case the responsibility of the auditor is clear and SA 265 is there to guide the auditor. Further guidance from ICAI in such a case would be on the application of the standard with enough illustrations to be of practical use.

( The author can be contacted at anilkay.rao@gmail.com)