So you Received an Internal Control Letter. Now what?

If you are part of organization that is audited or have been involved in audits with a prior organization, you understand that audits can cause a significant amount of stress and anxiety. This is especially true when there are audit adjustments or other deficiencies identified and an internal control letter is issued to the governing board. It’s no surprise that this letter can cause some strain on the relationship between the client and the auditor.

First, what is the purpose of the letter?

Auditors are required by professional standards to report, in writing, internal control matters that they believe should be brought to the attention of those charged with governance (the board). Generally, if your auditor is going to put an internal control matter in a letter, they have assessed that the matter was the result of a deficiency in internal controls. This is an important part of that audit that the profession does not take lightly. Auditors spend a lot of time assessing how material audit adjustments and immaterial adjustments that have the potential to be material will be communicated in the internal control letter. Even if no adjustments are identified during the audit, a letter could be issued in the event that there is a significant recommendation the auditors would like to make, which may include enhancing internal controls, additional training for employees, system improvements or even governance recommendations.

As noted above, an internal control letter is usually the result of a deficiency in internal controls discovered during the audit, most commonly from a material audit adjustment. The letter includes required language regarding the severity of the deficiency. Depending on materiality and other qualitative factors, the auditors will consider the deficiency to be an “other” matter, significant deficiency, or material weakness. The auditor has discretion on which category the deficiency falls into, but are otherwise required to use the standard wording and definitions in the letter.

So you received an internal control letter. Now what?

First, take a deep breath! Receiving this letter is not the end of the world. The main purpose is to make note of areas that need to be addressed and is not meant to be punitive. Below are some ways to help work through an internal control letter and make the experience a little less stressful:

• Deficiency Identified: As part of the audit internal control letter, the auditor will identify what the deficiency was and issue a recommendation. Ask them about their assessment of the issue and ask them to provide meaningful and tangible recommendations. There is nothing worse than receiving an internal control letter that does not provide a meaningful recommendation on how to resolve the issue in the future. You may also have your own recommendations on how to address the issue. Discuss this with the auditor because you have valuable insight into the operations of your organization.
• Early Communication: Be sure to discuss any material audit adjustments or recommendations with your auditor as soon as they are identified. You’ll then want to bring this to the attention of your board. This early communication helps the board members understand that 1) the root of the deficiency has been identified, 2) tangible recommendations have been made and 3) you are proactively working on the issue. Board members appreciate this early communication as it gives them the opportunity to provide some insight they may have on the topic. Further, it prevents any surprises when the board receives the final letter and audited financial statements.
• Response: This is your chance to give some additional context on the issue and the steps you have taken or will take to address the deficiency. To a board member, this may be the most important part of the letter. If a deficiency has been identified they want to know what management is going to do to address the issue. Seeing new internal controls put in place or active steps towards addressing the issue puts their mind more at ease because then they know that the recommendation is being taken seriously.
• Next Year: Now that you have your letter, you have the chance to prevent it from being issued in the following year. Take the recommendations and implement your response. Since the auditor will be looking at whether the recommendations were implemented during the following year’s audit, be sure to communicate early on what you did to address the issue.

Nobody likes to receive an internal control letter, but remember the purpose is to improve your organization’s internal control. It may also result in increased efficiencies and open doors to new ideas. If you communicate early and follow through on the recommendations, all stakeholders will feel better about the results.

© Clark Nuber PS, 2014.  All Rights Reserved