Misconceptions by management exist about what it means to have a finding reported in the schedule of findings and questioned costs. Some may believe that to receive a finding means they may lose their job, while others may ignore the information all together. What then is a finding? What do they mean? What do they tell us?
To answer these questions one must first understand why the auditor has to report them to you. If you are one of the many organizations that receive state or federal funds, you are aware that there are additional reporting requirements as a recipient of these funds. Your year-end reporting package as required by Government Auditing Standards, OMB Circular A-133, and the Louisiana Audit Guide, includes several auditor prepared reports. These include the auditor’s report on the financial statements, a report on internal control over financial reporting and compliance and other matters, and a report on compliance for each major program and on internal control over compliance, and a schedule of findings and questioned costs.
An audit is designed to provide assurance on the financial statements. An audit is not designed to identify deficiencies in internal control or areas of noncompliance. Nonetheless, an auditor reviews the internal controls to determine the audit strategy and compliance with certain laws, regulations, contracts or grants in order to determine whether the financial statements might be misstated as a result of that noncompliance. However, if an audit identifies internal control issues or instances of noncompliance; they are required to be reported in writing by authoritative standards. There are two types of internal control findings which may be identified by the auditor. These are as follows:
Noncompliance might involve a range of issues, including those pertaining to federal or state grants, payroll matters, restrictions of tax propositions, violations of debt covenants, state bid law, the Local Government Budget Act, or others that might affect the financial statements. Additionally, it is important to remember that a compliance exception could be an indicator of a potential deficiency in internal control over compliance and therefore result in a finding in both areas as the picture below illustrates.
When evaluating a compliance finding, one should consider the frequency, nature, adequacy of the organization’s system for monitoring compliance and the possible effects of any noncompliance to the financial condition of the organization or its impacts to current and future grant funding. For internal controls, the findings are often remedied simply by fixing the deficiency going forward. Unless fraud is involved, noncompliance matters are usually remedied through a later decision from a grantor, creditor or other external stakeholder and may or may not require the return of funds (although this doesn’t happen often). The law, regulation, contract, or grant with which the noncompliance may have occurred may be subject to varying interpretations and may be considered a non-issue upon review by the stakeholder. Just because the cop wrote you a ticket, doesn’t necessarily mean you have to pay.
To more clearly explain the matters reported by auditors, standards require certain components to a finding as described below:
In summary, organizations are managed and governed by human beings who are imperfect. There’s no shame in having a finding in your report, only in failing to act to remedy the cause of the finding. If taken in the proper context, a finding can be an opportunity to improve knowledge and processes thereby allowing an organization to better serve its customers and constituents.