SAS No. 94: New Standards on Technology and Internal Control

By Gary A. Porter CPA

Technology offers associations many conveniences, but it can also diminish an auditor’s ability to obtain the desired assurance of balances from substantive year-end tests, primarily because no paper trail exists. Thus, in May 2001, the Auditing Standards Board of the American Institute of CPAs (AICPA) issued Statement on Auditing Standards (SAS) No. 94: The Effect of Information Technology on the Auditor’s Consideration of Internal Control in a Financial Statement Audit. This new statement is an amendment to SAS No. 55: Consideration of Internal Control in a Financial Statement Audit. Since many companies currently operate in a completely electronic environment, the need for this amendment is obvious.

This new standard sets forth several important concepts. Control standards must correspond to the increased volume and complexity of transactions. In the past, most auditors used a memorandum or a checklist to document their findings, a system that was sufficient when working with relatively few transactions. Thanks to technology, however, auditors will have to expand their documentation to include flowcharts, questionnaires, or decision tables to document their understanding of the system of internal control.

The auditor is required to design procedures to understand the control mechanisms and assess control risk for the account balance, transaction class, and disclosure components of the financial statement. If the auditor assesses control risk at the maximum level, it will require significant substantive tests to determine the accuracy of the recorded amounts. If the auditor assesses control risk below the maximum level, it may be more efficient to perform control tests rather than substantive tests. In addition, when financial data exist only in electronic form, the auditor’s ability to obtain the desired assurance only from substandard tests is significantly diminished. This may mean that it is not possible to restrict detection risk to an acceptable level only by the performance of substantive tests. Instead, control tests may be required.

One of the key concepts in SAS No. 94 is that evidential manner may be obtained from tests of controls, planned and performed concurrent with, or subsequent to, obtaining the understanding. Such evidential matter may also come from procedures that were not specifically planned to test controls, but that nevertheless provide evidential matter about the effectiveness of the design and operation of the control.

In our firm, we have long performed limited tests of expenditures by stratifying transactions and looking at high-dollar-value transactions. This is a type of substantive test, and provides the auditor with evidence of the accuracy of recorded balances for the larger-dollar-value transactions by examining underlying documentation. By virtue of looking at the key existing controls to make sure that a transaction is properly recorded, classified, approved, and authorized, we are also testing the controls at the same time. Having relied upon this process to perform our own tests of our own controls for a number of years, it’s nice to finally see it in writing from the AICPA.

The new SAS also points out that technology enables firms to improve effectiveness and efficiency in the following ways:

1) Consistently apply predefined business rules and perform complex calculations when processing large- volume transactions or data.
2) Enhance the timeliness, availability, and accuracy of information.
3) Facilitate additional analysis of information.
4) Enhance the ability to monitor the performance of the entity’s activities and its policies and procedures.
5) Reduce the risk that controls will be circumvented.
6) Enhance the ability to achieve effective segregation of duties by implementing security controls in applications, databases, and operating systems.

At the same time, SAS 94 also describes the specific risks technology poses to internal control, including:

1) Reliance on systems or programs that are inaccurately processing data, processing inaccurate data, or both.
2) Unauthorized access to data may result in destruction of data, improper changes to data, including the recording of unauthorized or nonexistent transactions, or inaccurate recording of transactions.
3) Unauthorized changes to data in master files.
4) Unauthorized changes to systems or programs.
5) Failure to make necessary changes to systems or programs.
6) Inappropriate manual intervention.
7) Potential loss of data.

SAS 94 states that, while planning an audit, the knowledge gained in obtaining an understanding of internal control and determining whether the controls have been placed should be used to:

1) Identify types of potential misstatement.
2) Consider factors that affect risk of material misstatement.
3) Design tests of controls when applicable.
4) Design substantive tests.

Once the auditor has documented this understanding, assessing risk is the next consideration. If the auditor determines that it is more effective or efficient to assess the control risk at less than the maximum level, the auditor should, for the specific assertion involved, consider:

1) The nature of the assertion.
2) The volume of transactions or data related to the assertion.
3) The nature and complexity of the systems, including the use of technology, by which the entity processes and controls information supporting the assertion.
4) The nature of the available evidential matter, including audit evidence that is available only in electronic form.

Assessing control risk at the below the maximum level involves:

1) Identifying specific controls relevant to specific assertions.
2) Performing tests of controls.
3) Assessing control risk.

While this statement on auditing standards, issued in May 2001, is not new, it is effective for periods beginning on or after June 1, 2001. That means we are just now beginning to audit associations for fiscal years ended May 31, June 30, and beyond. Such cases will require application for the first time of this auditing standard. Auditors need to be aware that this statement on auditing standards exists, and to comply with its provisions.

Gary Porter, CPA began his accounting career with the national CPA firm Touche Ross in 1971.  He is licensed by the California Board of Accountancy and the Nevada Board of Accountancy.  Mr. Porter has restricted his practice to work only with Common Interest Realty Associations (CIRAs), including homeowners associations, condominium associations, property owners associations, timeshare associations, fractional associations, condo-hotels, commercial associations, and other associations.

Gary Porter is the creator and coauthor of Practitioners Publishing Company (PPC) Guide to Homeowners Associations and other Common Interest Realty Associations, and Homeowners Association Tax Library.  Mr. Porter served as Editor of CAI’s Ledger Quarterly from 1989 through 2004 and is the author of more than 200 articles.  In addition, he has had articles published in The Practical Accountant, Common Ground and numerous CAI Chapter newsletters.  He has been quoted or published in The Wall Street Journal, Money Magazine, Kiplinger’s Personal Finance, and many major newspapers.

Mr. Porter is a member of Community Associations Institute (CAI), American Resort Development Associations (ARDA), and California Association of Community Managers (CACM).  Mr. Porter served as national president of CAI in 1998 – 1999.