In 2021, the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) issued Statement on Auditing Standards (SAS) No. 145, titled “Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement.”
This standard, effective for audits of financial statements for periods ending on or after December 15, 2023, introduces significant changes to how auditors assess risks during audits. These changes hold particular importance for smaller nonprofits, which may have limited resources and simpler organizational structures.
Key Changes Introduced by SAS 145
SAS 145 aims to enhance the auditor’s risk assessment process by providing more robust guidelines on understanding the entity and its environment, including its internal controls. Some of the key changes include:
1. Revised Risk Assessment Procedures: SAS 145 emphasizes a more thorough assessment of the entity’s environment, including a deeper understanding of the entity’s objectives, strategies, and related business risks. For smaller nonprofits, this means auditors will need to consider how external factors, such as economic conditions or regulatory changes, could impact the organization’s financial statements.
2. Focus on Controls: Auditors are now required to focus more on the design and implementation of internal controls, even in smaller organizations where such controls might be less formal. This could lead to auditors recommending more robust control processes, even for smaller nonprofits with limited resources.
3. Increased Emphasis on IT Systems: SAS 145 also places a stronger focus on the role of IT systems in financial reporting. Smaller nonprofits, which may rely on basic accounting software, will need to ensure these systems are adequately designed to prevent and detect errors.
For smaller nonprofits, the implementation of SAS 145 could mean more detailed audits, potentially leading to higher audit costs. However, the standard’s emphasis on understanding the entity’s environment and risks can also lead to more meaningful audit results, helping these organizations improve their financial management practices. Unfortunately, the auditor has limited means for providing this feedback. It will most likely be in the form of a management comment letter in which a control deficiency will be identified.
As an auditor, we are seeing that most of our clients, which are smaller nonprofit organizations, have very good processes for the size of the organization. However, the size limits the strength of the controls in place. SAS 145 and our communication regarding the controls is not meant to say that the processes that have been in place are no longer effective. In most cases, we are saying that the process may need another step or more formal documentation.
This is an opportunity for you and your auditor to partner and create an organization with financial oversight and potentially fewer errors in financial statements, contributing to greater transparency and trust among donors and stakeholders.
