About
Foundational Principles In the Community Diversity, Equity & Inclusion Technical Excellence Alumni TIAG Membership
Careers
Why Cohen & Company Our Culture Total Rewards & Benefits Intern & Entry Level Opportunities Experienced Opportunities
Contact
Akron, OH Baltimore, MD Chicago, IL Cleveland, OH Detroit, MI Milwaukee, WI New York, NY Philadelphia, PA Pittsburgh, PA St. Clair Shores, MI Youngstown, OH
Client Portal
Services Industries Knowledge Center People

About Our Services

We offer tailored solutions — whether private company or owner; public or private fund, adviser or fund service provider; or Fortune 1000 enterprise. Learn how we can help you.

Learn More

Assurance Services

Employee Benefit Plan Audits Internal Controls Investment Company Audits Private Company Audits SOC Readiness & Compliance

Tax Services

Federal Tax Planning & Compliance High Net Worth & Wealth Transfer International Filings & Structuring Investment Company Tax State & Local Tax Tax Credits & Incentives Transaction Tax Planning

Advisory Services

Business Valuations Data & Insights Digital Finance Solutions IT Strategy & Implementation M&A Advisory Outsourced Accounting Solutions Risk Assurance & Advisory Transaction Services Turnaround & Restructuring

Our Industry Expertise

Our industry experience means you can find professionals who speak your language and bring earned insights to the table. Learn how we can help you.

Learn More

Key Industries

Digital Assets Investment Companies Manufacturing Private Companies Private Equity Real Estate & Construction Technology & Life Science
VIEW THE COMPLETE LIST

Knowledge Center

Our team wants to help your team stay up to date. Browse our thought leadership, events and news for insights and a point of view on business-critical topics.

Learn More

Insights

Browse valuable articles and publications our experts have written to help you and your organization answer key questions — and consider new ones.

Read Our Insights

Events

Join us in person and online for events that address timely topics and key business considerations.

Explore Our Events

News

Find out what is happening at Cohen & Company, from industry recognitions and growth updates, to where we are contributing to important media stories.

Read Our News
People
Foundational Principles In the Community Diversity, Equity & Inclusion Technical Excellence Alumni TIAG Membership
Why Cohen & Company Our Culture Total Rewards & Benefits Intern & Entry Level Opportunities Experienced Opportunities
Akron, OH Baltimore, MD Chicago, IL Cleveland, OH Detroit, MI Milwaukee, WI New York, NY Philadelphia, PA Pittsburgh, PA St. Clair Shores, MI Youngstown, OH
Client Portal
Back to Insights

Will Your Private Company’s Internal Controls Pass the Test During Your Next Audit?

March 08, 2023 Assurance Services, Private Company Audits, Internal Controls

A solid system of internal controls for any organization translates into more reliable financial reporting and can help companies prevent, detect and correct financial misstatements. In contrast, weak controls can result in costly errors — and even fraud.

And while internal controls are certainly important for publicly traded companies, they may be even more critical for smaller private companies — regardless if they have prepared financial statements or not. These companies are often more susceptible to fraud caused by weak controls, and tend to have less sophisticated internal audit and accounting departments than public companies. As a result, many companies, particularly those required to have an audit of their financial statements, are spending more time assessing and improving their internal controls.

5 Components of Internal Controls and 2 Types of Deficiencies

According to the Committee of Sponsoring Organizations of the Treadway Commission (COSO), internal controls should be “designed to provide reasonable assurance of the achievement of objectives in the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with laws and regulations.”

COSO lists five components of internal controls:

  1. Control environment,

  2. Risk assessment,

  3. Control activities,

  4. Information and communication, and

  5. Monitoring.

Companies must continually review and improve internal control performance. For companies with audited financial statements, AICPA standards also require external auditors to evaluate their client’s internal controls as part of their audit risk assessment procedures. Private auditors tailor audit programs for potential risks of material misstatement, but they aren’t required to specifically perform procedures to identify control deficiencies — unless they’re hired to perform a separate internal control study.

Although under AU-265, Communicating Internal Control Related Matters Identified in an Audit, the auditor is required to communicate to those charged with governance and management any deficiencies in internal control the auditor has identified during the audit and that, in the auditor's professional judgment, are of sufficient importance to merit attention. If the auditor has identified one or more deficiencies in internal control, the auditor should evaluate each deficiency to determine, on the basis of the audit work performed, whether, individually or in combination, the deficiencies constitute a material weakness or a significant deficiency. Each type of deficiency is defined below:

1. Material Weaknesses. Such shortcomings refer to “a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.”

2. Significant Deficiencies. This type of concern is “less severe than a material weakness, yet important enough to merit attention by those charged with governance.” Note that a control deficiency is dependent on the potential for misstatement; misstatement need not actually have occurred.

When classifying deficiencies as material weaknesses or significant deficiencies, auditors evaluate the probability and magnitude of the potential misstatement. They also consider “compensating controls,” which are substitute procedures that limit the severity of a deficiency.

How to Improve Your Internal Controls

If your organization has control deficiencies, whether determined by a formal audit or by management review, you must act to reduce the severity. There are many types of controls you can implement to help:

  • Performance Reviews — Budget vs. actual, comparing internal data from external sources, reviewing performance by business line

  • Automated Controls — Editing checks of input data

  • Reconciliations — Reviewing account, bank and aging reconciliations

  • Management Review - Checking the arithmetical accuracy of records, reviewing accounts, journal entries and trial balances

  • Physical Controls — Periodic counting and comparison with amounts shown on control records for cash, fixed assets or inventory

  • Segregation of Duties — Assigning different people the responsibilities of authorizing transactions, recording transactions and maintaining custody of assets

  • To implement any new controls effectively, you must train employees not only on how to implement them but also why they are important. Subsequently, management must develop an action plan to enforce the new controls and formally sign off on any documents or accounts they review to ensure they are setting the appropriate tone at the top. Employees’ understanding and follow-through on these controls, which are embedded in critical daily processes, are key to reducing the likelihood of costly errors and fraud in the future.

If your organization does not have the internal resources to identify where the organization is most at risk in its internal control structure, working with third-party advisers to provide management with an objective perspective and meaningful recommendations for improvement may help.

Contact Tina Dzik at tdzik@cohencpa.com or a member of your service team to discuss this topic further.

Cohen & Company is not rendering legal, accounting or other professional advice. Information contained in this post is considered accurate as of the date of publishing. Any action taken based on information in this blog should be taken only after a detailed review of the specific facts, circumstances and current law.

Sign Up for Our Emails & Events

Receive insights from our specialists in a variety of areas and timely information on upcoming events directly to your inbox as they go live in our online Knowledge Center.

Subscribe Today
Subscribe to our newsletter
About Contact Submit RFP Privacy Policy
LinkedIn Twitter Facebook
© 2023 Cohen & Company