Evaluating ITGC deficiencies and their effect on the audit

• Link an ITGC deficiency to the automated controls, reports and accounts it affects
• Apply the AS 2201 and Regulation S-X deficiency definitions
• Evaluate compensating controls and direct testing as responses
• Decide the communication and audit response for ITGC deficiencies

Start with the definitions

AS 2201.A3 says a deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

Regulation S-X Rule 1-02(a)(4) and AS 2201.A7 define a material weakness as a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or combination, that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of financial reporting (AS 2201.A11). AU-C 265 uses parallel definitions for nonissuer audits.

Why ITGC deficiencies are different

An ITGC deficiency rarely misstates anything directly. A developer with production access has not changed revenue by having access. The question is what the deficiency puts at risk: the automated controls, IT-dependent manual controls and reports that rely on the ITGC.

A five-step evaluation

1. Map dependencies. List every automated control and report that depends on the deficient ITGC, and the accounts and assertions those support. Use the risk and control matrix from lesson 3.
2. Determine what actually happened. For access deficiencies, review activity logs for the excess access. For change deficiencies, inspect what changed. If you can show the access was not used inappropriately or the program did not change, the risk of misstatement is lower.
3. Test the dependent controls directly. If you cannot rely on the ITGC, test the automated control or report at more points in the period, or reperform it over the period.
4. Look for compensating controls. AS 2201.68 requires the auditor to evaluate compensating controls, and says that to have a mitigating effect, the compensating control should operate at a level of precision that would prevent or detect a misstatement that could be material.
5. Conclude on severity. Consider whether there is a reasonable possibility that the deficiency, alone or combined with others, would fail to prevent or detect a misstatement, and the magnitude of the potential misstatement.

Pervasive deficiencies

A deficiency in a pervasive ITGC (for example, unrestricted domain administrator access across all systems) affects many applications at once. Combine it with other deficiencies in the same domain and evaluate them together. Several access deficiencies across applications may add up to a significant deficiency or material weakness even if each alone is minor. AS 2201.65 directs the auditor to determine whether deficiencies affecting the same significant account, relevant assertion or component of internal control collectively result in a material weakness.

The audit response

For the financial statement audit, an ITGC deficiency usually means:

• not relying on affected automated controls for the period, or obtaining direct evidence;
• testing IPE each time it is used instead of relying on change management;
• increasing substantive procedures over affected accounts.

For an integrated audit, the deficiency enters the AS 2201 evaluation of whether ICFR is effective as of year-end, including whether it was remediated and the remediated control operated long enough to be tested.

Communication

Communicate significant deficiencies and material weaknesses in writing to management and those charged with governance (AU-C 265 for nonissuers; AS 2201 for issuers). Other deficiencies go to management. Describe the ITGC deficiency in business terms: what the gap allows and what could result, not only the technical condition.

Common mistakes

• Concluding "no impact" because no misstatement was found, without evaluating what could have happened.
• Evaluating each application's deficiency alone instead of in combination.
• Accepting a compensating control that is not precise enough, such as a high-level analytical review.

Use the deficiency evaluation worksheet to document the mapping, testing and conclusion.

Developer access at Northgate Components, an issuer