Misstatements and Internal Control Deficiencies
Evaluating misstatements identified during the audit and assessing internal control deficiencies are critical steps before the auditor can form an opinion. The auditor must accumulate all misstatements — corrected and uncorrected — determine their effect on the financial statements individually and in the aggregate, and evaluate any internal control deficiencies discovered during the engagement. These evaluations directly influence the auditor's opinion, required communications, and the overall assessment of internal control over financial reporting.
This section covers the types of misstatements, how to evaluate their significance, the classification of internal control deficiencies, communication requirements, and the concepts of tolerable misstatement and the clearly trivial threshold.
Types of Misstatements
Misstatements are differences between the amount, classification, presentation, or disclosure of a reported financial statement item and the amount, classification, presentation, or disclosure that is required for the item to be in accordance with the applicable financial reporting framework.
There are three categories of misstatements:
| Type | Description | Example |
|---|---|---|
| Factual misstatements | Misstatements about which there is no doubt — the item is clearly wrong | Bear Co. recorded a $50,000 invoice twice, creating a definite overstatement of expenses |
| Judgmental misstatements | Differences arising from management's judgments concerning accounting estimates that the auditor considers unreasonable, or the selection or application of accounting policies that the auditor considers inappropriate | Gies Co. estimates its warranty liability at 350,000 is more appropriate based on historical claim data |
| Projected misstatements | The auditor's best estimate of misstatements in populations, based on projecting misstatements identified in audit samples to the entire population | The auditor finds 120,000 |
All three types of misstatements must be accumulated and evaluated. Factual misstatements are the most straightforward, but judgmental and projected misstatements often require more careful consideration and discussion with management.
Preparing a Summary of Misstatements
The auditor must accumulate all misstatements identified during the audit, other than those that are clearly trivial. This summary should include:
- Corrected misstatements — errors that management agreed to adjust during the audit
- Uncorrected misstatements — errors that management declined to correct or that the auditor identified but did not request correction for
Why Track Corrected Misstatements?
Even though corrected misstatements no longer affect the financial statements, the auditor tracks them because:
- A pattern of corrected misstatements may indicate a control deficiency
- If many adjustments are needed, it may signal broader issues with the entity's accounting processes
- The nature and volume of corrections can influence the auditor's risk assessment for future periods
Example: During the audit of Kingfisher Industries, the auditor identifies 14 misstatements totaling $380,000 in the revenue cycle. Management corrects all 14. Although the corrected financial statements are now fairly stated, the volume of errors suggests a significant deficiency in controls over revenue recording.
Evaluating Uncorrected Misstatements
Individual and Aggregate Evaluation
The auditor must evaluate uncorrected misstatements both individually and in the aggregate to determine whether they are material to the financial statements as a whole.
| Evaluation Level | What the Auditor Considers |
|---|---|
| Individual | Does any single uncorrected misstatement, by itself, exceed materiality for the financial statements as a whole or performance materiality? |
| Aggregate | Do all uncorrected misstatements combined — including the net effect of prior-period uncorrected misstatements carried forward — exceed materiality? |
Even if no single misstatement is material on its own, the cumulative effect of multiple small misstatements can render the financial statements materially misstated. The auditor must always consider the aggregate.
Quantitative Considerations
Quantitative analysis focuses on the dollar amount of uncorrected misstatements relative to:
- Overall materiality for the financial statements as a whole
- Performance materiality
- Materiality levels for specific accounts, classes of transactions, or disclosures (if applicable)
Example: The auditor sets materiality for Illini Entertainment at 120,000 (inventory overstatement), 180,000 (misclassified revenue). Individually, none exceed materiality. In the aggregate, the net effect is $395,000, which is below materiality — but the auditor must still consider qualitative factors.
Qualitative Considerations
Quantitative analysis alone is not sufficient. The auditor must also consider qualitative factors that may make an otherwise immaterial misstatement material:
| Qualitative Factor | Example |
|---|---|
| Effect on compliance | A $30,000 misstatement causes Bear Co. to violate a debt covenant ratio |
| Effect on management compensation | An uncorrected misstatement causes earnings to meet a bonus threshold |
| Effect on trends | A misstatement converts a reported loss into a profit, reversing a trend |
| Masking a change in earnings | Without the misstatement, declining performance would be apparent |
| Effect on segment information | A small misstatement is material to a reportable segment |
| Known vs. likely vs. projected | Factual misstatements carry more weight than projected estimates |
| Potential effect on future periods | An error in depreciation affects all future periods |
On the CPA exam, watch for scenarios where the dollar amount is below materiality but a qualitative factor makes it material. A classic example is a misstatement that causes a company to just barely meet a debt covenant or a management bonus target.
Tolerable Misstatement and the Clearly Trivial Threshold
Tolerable Misstatement
Tolerable misstatement (also called performance materiality in certain contexts) is the amount set by the auditor at less than materiality for the financial statements as a whole. It is used to:
- Reduce the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality
- Guide the auditor in determining the nature, timing, and extent of audit procedures for individual accounts
Example: If overall materiality for BIF Partners is 750,000 (75% of materiality) to provide a cushion for undetected misstatements.
Clearly Trivial Threshold
The auditor designates an amount below which misstatements are clearly trivial — meaning they are inconsequential whether taken individually or in the aggregate.
- Misstatements below the clearly trivial threshold need not be accumulated on the summary of misstatements
- This threshold is typically set at a small percentage (often 5% or less) of overall materiality
| Concept | Relationship to Materiality | Purpose |
|---|---|---|
| Overall materiality | Base amount | Determines the auditor's opinion |
| Performance materiality / Tolerable misstatement | Less than overall materiality | Provides a buffer for undetected errors |
| Clearly trivial | Much less than materiality | Eliminates immaterial items from accumulation |
"Clearly trivial" is not the same as "not material." A misstatement that is not clearly trivial must still be accumulated and evaluated, even if it appears to be immaterial on its own.
Internal Control Deficiency Classifications
When the auditor identifies a deficiency in internal control, it must be evaluated to determine its severity. The classification determines the auditor's communication obligations.
Definitions
| Classification | Definition |
|---|---|
| Deficiency | A control is designed, implemented, or operated in a way that does not allow management or employees to prevent or detect misstatements on a timely basis. OR a necessary control is missing. |
| Significant deficiency | A deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness but important enough to merit the attention of those charged with governance. |
| Material weakness | A deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. |
Severity Assessment Factors
The auditor evaluates the severity of a deficiency by considering:
- Likelihood — the probability that the deficiency could result in a misstatement
- Magnitude — the potential dollar amount of the misstatement that could result
| Low Magnitude | High Magnitude | |
|---|---|---|
| Low Likelihood | Deficiency | Significant deficiency |
| High Likelihood | Significant deficiency | Material weakness |
Example: Illini Security has no segregation of duties in its cash disbursements process — the same employee authorizes, records, and reconciles payments. The magnitude of potential misstatement is high (the entire cash disbursements balance), and the likelihood is high (there is no compensating control). This represents a material weakness.
Example: MAS Inc. occasionally fails to obtain a second signature on purchase orders over $10,000, though a supervisor reviews the monthly purchasing report. The magnitude is moderate and the likelihood is low due to the compensating control. This is likely a deficiency or possibly a significant deficiency.
Impact on Audit Procedures
The identification of internal control deficiencies directly affects the auditor's assessment of control risk, which in turn influences the nature, timing, and extent of further audit procedures.
| Deficiency Severity | Impact on Audit Procedures |
|---|---|
| Deficiency | May result in minor adjustments to planned substantive procedures |
| Significant deficiency | Auditor may increase the extent of substantive testing, perform procedures closer to year-end, or use more reliable types of evidence |
| Material weakness | Auditor cannot rely on controls in the affected area; must adopt a fully substantive approach with increased sample sizes, more year-end testing, and enhanced procedures |
If a material weakness exists in an integrated audit (under PCAOB standards), the auditor must issue an adverse opinion on the effectiveness of internal control over financial reporting, even if the financial statements themselves are fairly stated.
Example: During the audit of Gies Co., the auditor discovers that the company has no review process for journal entries posted by the controller. This material weakness in the journal entry approval process leads the auditor to:
- Expand testing of non-standard journal entries
- Test journal entries throughout the year rather than only at year-end
- Increase the sample size for journal entry testing
- Consider the implications for the risk of management override of controls
Communication Requirements
AICPA Requirements (AU-C 265)
| What to Communicate | To Whom | When |
|---|---|---|
| Significant deficiencies | Those charged with governance | In writing, no later than 60 days after the report release date |
| Material weaknesses | Those charged with governance | In writing, no later than 60 days after the report release date |
| Material weaknesses | Management | In writing, no later than 60 days after the report release date |
| Significant deficiencies | Management | In writing (unless already communicated to governance and management is part of governance) |
PCAOB Requirements (AS 2201 / AS 5)
For integrated audits of issuers, additional requirements apply:
| What to Communicate | To Whom | Additional Requirements |
|---|---|---|
| Material weaknesses | Management and audit committee | Must be reported in the auditor's report on internal control |
| Significant deficiencies | Management and audit committee | Written communication required |
| All deficiencies | Management and audit committee | All identified deficiencies must be communicated |
Under SAS 134 (now codified in AU-C 260), the auditor's communication with those charged with governance should include significant findings from the audit, including significant difficulties encountered, disagreements with management, and other matters significant to the oversight of the financial reporting process.
What the Communication Must Include
The written communication of significant deficiencies and material weaknesses must include:
- A description of the deficiency and an explanation of its potential effects
- The definition of a significant deficiency or material weakness (as applicable)
- A statement that the purpose of the audit was to express an opinion on the financial statements (not to provide assurance on internal control — unless an integrated audit)
- A statement that the communication is intended solely for the use of management and those charged with governance
Putting It All Together: The Evaluation Process
The following steps summarize the auditor's evaluation process near the end of the audit:
- Accumulate all identified misstatements (except those that are clearly trivial)
- Communicate misstatements to the appropriate level of management and request correction
- Reassess materiality if necessary in light of actual financial results
- Evaluate uncorrected misstatements individually and in the aggregate, considering both quantitative and qualitative factors
- Request a written representation from management that the effects of uncorrected misstatements are immaterial
- Classify any internal control deficiencies identified during the audit
- Communicate significant deficiencies and material weaknesses in writing to governance and management
- Determine the effect on the auditor's opinion — if uncorrected misstatements are material (individually or in aggregate), and management refuses to correct them, the auditor must modify the opinion
Example: The auditor of BIF Partners identifies 200,000. Management declines to make corrections. The auditor considers the qualitative factors and concludes the misstatements are material in the aggregate. Because management refuses to correct, the auditor issues a qualified opinion (assuming the misstatements are material but not pervasive).
Summary
| Concept | Key Points |
|---|---|
| Factual misstatements | Definite errors with no doubt — clearly wrong amounts |
| Judgmental misstatements | Differences arising from unreasonable estimates or inappropriate accounting policies |
| Projected misstatements | Best estimate of total population misstatement based on sample results |
| Clearly trivial | Threshold below which misstatements need not be accumulated |
| Tolerable misstatement | Set below overall materiality to provide a buffer for undetected errors |
| Deficiency | A control does not allow timely prevention or detection of misstatements |
| Significant deficiency | Less severe than a material weakness but merits governance attention |
| Material weakness | Reasonable possibility of undetected material misstatement |
| Communication — AICPA | Significant deficiencies and material weaknesses communicated in writing within 60 days of report release |
| Communication — PCAOB | All deficiencies communicated to management and audit committee; material weaknesses reported in the auditor's report on ICFR |
| Aggregate evaluation | Must evaluate all uncorrected misstatements combined, not just individually |
| Qualitative factors | May render a quantitatively immaterial misstatement material (e.g., covenant violations, bonus thresholds) |