Members in Government Guide to Internal Control and Internal Control Services
Members in government, both mangers and auditors, must understand the concepts of internal control and independence and the effect they have on the CPA practitioners that the government hires for both its financial statement audits and for other nonaudit engagements related to internal control services. As auditing standards have evolved, the auditors may no longer default to a maximum control risk but now should obtain a sufficient understanding of internal control by performing risk assessment procedures to evaluate the design of controls relevant to an audit of financial statements and to determine whether they have been implemented.1 This may result in the auditor spending additional time. Additionally, internal control deficiencies identified by an auditor that upon evaluation are considered significant deficiencies or material weaknesses should be communicated in writing to management and those charged with governance.2 This standard also has led to a great deal of discussion about what is or is not a control and what role an auditor can play, with respect to the client’s system of internal control. Even if a CPA practitioner does not perform audits but performs reviews and compilations, it is important that he or she understand internal control because of the possible independence ramifications. A CPA practitioner’s independence would be impaired if he or she establishes or maintains internal control for a client.3 This paper describes the concepts of internal control (specifically internal control over financial reporting) and discusses the types of services related to internal control services that a governmental organization may hire a CPA practitioner to perform.

Paragraph .40 of AU section 314, Understanding the