Remediating deficiencies and reporting material weaknesses

• Build a remediation plan that addresses root cause and allows enough operation to test
• Determine whether a material weakness is remediated as of year-end
• Describe how material weaknesses are reported by management and the auditor
• Identify the written communications required under AS 2201.78 to .80

Remediation starts with root cause

A remediation plan that replaces one reviewer with another fixes a symptom. Before writing actions, agree the root cause with the process owner: missing control, poor design, lack of competence, workload, system limitation, or tone at the top. Then set actions, owners and dates, and the evidence that will show the fix works. Internal audit’s role under Standard 15.2 of the Global Internal Audit Standards is to confirm implementation through inquiry, risk-based follow-up testing and a tracking system, not to design the fix.

When does a fixed control count?

Management’s assessment is as of fiscal year-end (15 U.S.C. 7262(a)). Release 33-8810 says that if all material weaknesses found during the year are remediated by the end of the fiscal year, management may conclude ICFR is effective as of year-end, while considering whether disclosure of the remediated weaknesses is appropriate or required.

"Remediated" means the new or redesigned control has operated long enough to obtain evidence of operating effectiveness. AS 2201.53 says that if new controls achieve the objectives and have been in effect long enough for the auditor to assess design and operating effectiveness, the superseded controls need not be tested. How long is long enough depends on frequency: a daily control can produce a meaningful sample in weeks; a quarterly control replaced in November will have at most one occurrence before year-end. Plan remediation dates backward from year-end with the testing calendar in mind.

If a material weakness remains at year-end

Management cannot conclude ICFR is effective when one or more material weaknesses exist (Release 33-8810). The management report states that ICFR is not effective and discloses the material weakness. The release encourages disclosure that helps investors understand the cause of the weakness and its potential impact, and differentiates among weaknesses by their potential effect on the financial statements.

The auditor, under AS 2201.90, must express an adverse opinion on ICFR if one or more material weaknesses exist, unless there is a scope restriction. AS 2201.91 requires the report to include the definition of a material weakness and a statement that one has been identified, with an identification of the weakness described in management’s assessment. If management’s assessment omits the weakness, the auditor’s report says so.

The officers address the change in their quarterly certifications. 15 U.S.C. 7241(a)(6) requires the certifying officers to indicate whether there were significant changes in internal controls, including corrective actions on significant deficiencies and material weaknesses. Release 33-8810 also points to Item 308(c) of Regulation S-K for disclosure of material changes in ICFR.

Required auditor communications

• AS 2201.78: communicate all material weaknesses in writing to management and the audit committee before the ICFR report is issued.
• AS 2201.79: if the auditor concludes audit committee oversight is ineffective, communicate that in writing to the board.
• AS 2201.80: communicate significant deficiencies in writing to the audit committee, timely and before the report is issued.

A remediation plan that holds up

For each material weakness or significant deficiency, record:

1. the deficiency and root cause;
2. actions, owner and target date;
3. the date the remediated control starts operating;
4. the testing plan: who tests, sample size under the methodology, and the date results are due;
5. status reported to the audit committee each quarter.

After year-end

A material weakness reported at year-end stays open until remediated and tested. AS 6115 provides for an engagement in which the auditor reports on whether a previously reported material weakness continues to exist, which some companies use to show progress between annual reports.

Racing the calendar at Granger Medical Supply