What SAS No. 134 Means for Significant Risks Identified

Professional audit standards have long required communication of issues between an independent auditor and those charged with governance. The new audit standard SAS (Statement on Auditing Standards) No. 134, which became effective on December 31, 2021, has an updated requirement to communicate with those charged with governance about the “significant risks” identified by the auditor.

What is a Significant Risk?

A “significant risk” is an audit area in which the auditor believes the likelihood of a misstatement occurring and the magnitude of the potential misstatement necessitates extra close attention.

When exercising professional judgment about which risks are significant risks, the auditor considers several matters, including, but not limited to:

• Whether the risk is related to fraud
• Recent significant economic, accounting, or other developments
• The complexity of transactions
• Whether the risk involves significant transactions with related parties
• The degree of subjectivity in the measurement of financial information related to the risk, especially those measurements involving a wide range of measurement uncertainty
• Whether the risk involves significant unusual transactions

For example, a public university foundation receives a significant irrevocable split-interest arrangement (ISIA). Upon the payment of beneficiaries, the foundation will fund a new building at the university. The foundation is not only the lead interest, but the administrator of funds that is responsible to pay named beneficiaries (the intermediary). What could go wrong?

• The ISIA assets received, or receivable may not be at fair value, or based on highly subjective, or biased assumptions
• The liabilities to beneficiaries may not be valued properly, or may be paid untimely, incorrectly, or fraudulently
• The unconditional remainder interest to the foundation may not be calculated properly
• Administrative expenses related to the ISIA may be overstated or improperly apportioned
• Funds may be held in an account that is “off the books” of the foundation.

Potential Risk Areas in Governments

Some risk areas for government audits could include:

• Valuation of investment or hedging derivative instruments and alternative investments
• Landfill and pollution remediation liability estimates
• Valuation of OPEB and pension liabilities
• Grant and other donor revenues are recognized in accordance with timing and eligibility criteria, if applicable
• Tax revenues are recognized in the appropriate period and in accordance with period of availability considerations

What to Do with Significant Risk Items

The determination of significant risks allows the auditor to focus more on those audit areas more likely to contain errors. For these risks, the auditor will understand the entity’s controls, including control activities, relevant to that risk and, based on that understanding, evaluate whether such controls have been suitably designed and implemented to mitigate such risks. Furthermore, the auditor will perform audit procedures specifically responsive to that risk and tailored to the entity.

Communicating significant risks identified by the auditor helps those charged with governance understand those matters and why they require special audit consideration, learn more about risks and even consider additional procedures on those risks.

Managing and Understanding Risk in State and Local Governments

Risks are part of every organization’s operations, including state and local governments. Though risk cannot be eliminated, Eide Bailly can help your government manage and understand risk through:

• Operational risk assessments of programs, functions, or your entire government
• Cybersecurity risk analysis engagements
• Internal audit engagements
• Consultations on mitigating vulnerabilities to fraud, waste, and abuse

The Governmental Accounting Standards Board may require note disclosure of a government’s significant risks in the future. A proposed standard is in the process of release. Though the proposal is bound to be controversial, the issue of risks is something all governments need to react to.

Do you have questions about what significant risk findings mean for your organization?

LET'S TALK