Communications of Significant Deficiencies and Material Weaknesses

If your organization has had an audit performed, you may have received a SAS 115 letter from your auditors.  A SAS 115 letter, also known as a Communications of Significant Deficiencies and Material Weaknesses is a formal letter issued by auditors to communicate internal control deficiencies identified during a financial statement audit.  

SAS stands for Statement on Auditing Standards, and SAS 115 specifically provides guidance to auditors on how to evaluate and report deficiencies in internal control.  In addition to internal control deficiencies, it may also include more general recommendations that do not rise to the level of a control deficiency.   

The letter informs the organization’s management and those charged with governance (such as the audit committee or board of directors) about any significant deficiencies or material weaknesses in internal controls over financial reporting identified during the audit. 

The letter specifically includes the nature of the identified deficiencies (either significant deficiencies or material weaknesses), the potential impact these deficiencies could have on the financial statements, and recommendations for remediation or improvements in internal controls. 

Organizations should use this letter as an opportunity to make improvements in operations.    

Here’s an overview of the key differences between material weakness, significant deficiencies, and other recommendations that may be included in the letter:  

Material Weakness

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis. 

 Material weaknesses are the most serious type of control deficiency and indicate a high risk that errors or fraud could significantly affect the financial statements. 

 If a material weakness is identified, it must be reported to the organization’s audit committee or those charged with governance. 

 A material weakness may occur when the auditor must propose a significant number  of journal entries to correct balances.  Because these balances were not corrected until the audit, the statements used throughout the year by management were incorrect.   

 Significant Deficiencies 

A significant deficiency is less severe than a material weakness but important enough to merit attention by those responsible for oversight of the organization’s financial reporting. 

While it does not pose as high a risk as a material weakness, a significant deficiency still represents a control issue that could impact the financial reporting process. 

Significant deficiencies are also reported to the audit committee or governance body, but they are seen as less critical than material weaknesses. 

A significant deficiency may be reported in instances where there is a lack of segregation of duties within a particular area of the accounting function.   

Other Recommendations (Management Letter Comments) 

Other recommendations or management letter comments are observations and recommendations made by auditors for improving the efficiency and effectiveness of an organization’s operations, internal controls, or financial reporting practices. 

These comments typically do not represent serious deficiencies. Instead, they highlight areas where internal controls or procedures could be strengthened but do not pose a material risk to the financial statements. 

These types of comments may be included in the SAS 115 letter or communicated in a separate letter to management.  Management letter comments are not required to be disclosed in the financial statements or audit report. 

Examples of other recommendations may include ensuring that the organization pay for all purchases so that the organization’s sales tax exemption may be taken advantage of, as opposed to having employees make purchases in which they are required to pay sales tax.   

If your organization has received a SAS 115 letter, it is important that management understand the issues and develop a plan to address and correct the identified issues.  It is a best practice for management to write a response letter addressing each of the items noted.  This shows that management understands the issues and recognizes their importance.