Circular A-133 Revised to Conform with SAS 112
June 27, 2007
To enforce consistency with recent revisions to professional auditing standards, the Office of Management and Budget (OMB) has announced a revision to Circular A-133, "Audits of States, Local Governments, and Non-Profit Organizations." The June 26 Federal Register notice updates internal control terminology and related definitions used in Circular A-133 to reflect terminology consistent with AICPA Statement on Auditing Standard (SAS) 112, "Communicating Internal Control Related Matters Identified in an Audit." The update is also consistent with the recently revised Government Auditing Standards (GAS)--known as the Yellow Book--which requires SAS 112 terminology and definitions to be used in all financial audits performed under GAS.
SAS 112 introduces and defines the terms "control deficiency" and "significant deficiency," redefines "material weakness," and requires the auditor to communicate control deficiencies that are significant deficiencies or material weaknesses in internal control. The revisions to Circular A-133 replace references to "reportable conditions" and "material weakness" in internal control over financial reporting with the terms "significant deficiency" and "material weakness" as those terms are defined in both SAS 112 and GAS. The changes are effective for audits of periods ending on or after December 15, 2006.
Applicability to Compliance Audits
While SAS 112 and GAS only address financial reporting, Circular A-133 which implements the Single Audit Act, also requires the auditor to report on compliance with regulations and other requirements related to major federal programs. The Compliance Supplement to Circular A-133 lists 13 types of compliance requirements, plus program specific special tests and provisions, that are to be reviewed such as allowable costs, cash management, procurement, and real property management. Therefore, OMB is proposing to introduce similar definitions for control deficiencies in internal control over compliance:
A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect on a timely basis noncompliance with a type of compliance requirement of a federal program.
A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity’s ability to administer a federal program such that there is more than a remote likelihood that noncompliance with a type of compliance requirement of a federal program that is more than inconsequential will not be prevented or detected.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that material noncompliance with a type of compliance requirement of a federal program will not be prevented or detected. [Footnotes providing additional clarification have been omitted here.]
These definitions, which mirror those in SAS 112 relating to financial statements, were developed by the AICPA, in conjunction with OMB, in AICPA Auditing Interpretation No. 1, "Communicating Deficiencies in Internal Control Over Compliance in an Office of Management and Budget Circular A-133 Audit." AICPA has also issued updated illustrative Circular A-133 audit reports that can be accessed on their Governmental Audit Quality Center website.
What Will This Mean?
SAS 112 does not change the scope of what must be audited; it provides communication requirements for internal control deficiencies that are detected in financial statement audits. The focus of SAS 112 is on the internal controls over financial reporting; SAS 112 does not address other internal control components, such as effectiveness and efficiency of operations or compliance with laws and regulations. However, SAS 112 definitions potentially influence the approach and judgment used by auditors when interpreting year end adjustments, unique transactions, or audit findings. Even though SAS 112 is limited to audit findings within a financial statement audit, OMB's application of SAS 112 to the A-133 audit will require the auditor to apply the standards of "significant deficiency" and "material weakness" to compliance findings in non-financial areas as well. Consequently the overarching concern is that more deficiencies will rise to the level of significant deficiencies and material weaknesses that will need to be included in the auditor’s report.
NACUBO suggests members use prior-year audits as a benchmark for how you would have fared under the new audit standards, proactively address potential issues, and discuss remedies with their auditors. You may also want to look for opportunities to educate the institution’s board of trustees and other stakeholders about the changes to audit standards and terminology.
NACUBO will continue to analyze the impact this most recent change may have on college and university compliance audits. We are in conversation with OMB and national accounting firms to better understand the consequences.
NACUBO Contact: Sue Menditto, director of accounting policy, 202.861.2542
- NACUBO Expresses Concerns with ED Proposal to Expand Federal Financial Responsibility Rules
- IRS Proposes Modifications to 1098-T Reporting
- ED Policy to Require Annual Student Aid Compliance Audits Beginning FY17
- 2016 Planning and Budgeting Forum
September 19-20, 2016
- 2016 Big Opportunities for Small Institutions
September 20-21, 2016
- 2016 Tax Forum
September 25-27, 2016
- ON-DEMAND: The CBO's Role in Diversity and Inclusion on Campus
- ON-DEMAND: The Clery Act: Strategic Planning to Mitigate Institutional Risk
- ON-DEMAND: Title IX: Key Issues Surrounding Institutional Compliance
- ON-DEMAND: NACUBO Live! Higher Education Accounting Forum
- ON-DEMAND: Responsibility Center Management: Two Different Perspectives