As audit season begins for calendar-year entities, it’s important to review issues that may arise during fieldwork. One common issue is materiality. This concept is used to determine what’s important enough to be included in — and what can be omitted from — a financial statement. Here’s how materiality is determined and used during an external financial statement audit.

What is materiality? 

Under U.S. auditing standards and Generally Accepted Accounting Principles (GAAP), “The omission or misstatement of an item in a financial report is material if, in light of surrounding circumstances, the magnitude of the item is such that it is probable [emphasis added] that the judgment of a reasonable person relying upon the report would have been changed or influenced by the inclusion or correction of the item.”

This aligns with the definition of materiality used by the U.S. judicial system. However, it differs somewhat from the definition set by the International Accounting Standards Board. Under International Financial Reporting Standards (IFRS), misstatements and omissions are considered material if they, individually or in the aggregate, could “reasonably be expected to influence the economic decisions of users made on the basis of the financial statements.”

How do auditors determine the materiality threshold?

Auditors rely on their professional judgment to determine what’s material for each company, based on such factors as:

• Size,
• Industry,
• Internal controls, and
• Financial performance.

During fieldwork, auditors may ask about line items on the financial statements that have changed materially from the prior year. A materiality rule of thumb for small businesses might be to inquire about items that change by more than, say, 10% or $10,000. For example, if shipping or direct labor costs increased by 30% in 2023, it may raise a red flag, especially if it didn’t correlate with an increase in revenue. Businesses should be ready to explain why costs went up and provide supporting documents (such as invoices or payroll records) for auditors to review.

Establishing what’s material is less clear when CPAs attest to subject matters that can’t be measured — such as sustainability programs, employee education initiatives, or fair labor practices. As nonfinancial matters are taking on increasing importance, it’s critical to understand what information will most significantly impact stakeholders’ decision-making process. In this context, the term “stakeholders” could refer to more than just investors. It also could refer to customers, employees and suppliers.

For more information

Materiality is one of the gray areas in financial reporting. Contact us to discuss the appropriate materiality threshold for your upcoming audit.

Companies that work on customer-specific or long-term projects — such as homebuilders, contractors, custom manufacturers, and professional practices — generally track job costs to gauge the profitability of each project. In turn, this helps them bid future projects.

Unfortunately, the job-costing process tends to be cumbersome, causing some expenses to inadvertently fall through the cracks instead of being allocated properly. Here are six tips to track costs more easily and accurately:

1. Make job costing a priority. Accurate cost tracking requires the involvement of every level of your organization. If management puts an emphasis on the proper allocation of every possible cost (be it supplies, equipment usage, or labor hours), most employees will gladly help code direct costs within their control to the appropriate project.

2. Set up a user-friendly job-costing coding system. Tracking costs begins where employees work. That may be in your office or a remote office, at a job site, or in a factory. Often, that’s where materials are delivered and consumed — and where purchase decisions are made.

Frontline workers know which costs go with which projects. The trick is making it easy for them to flag the job name or number. That helps the person who’s entering transactions into the computerized accounting system identify the proper cost code. Accounting personnel may be tempted to guess when the job name or number isn’t available — or assign it to a miscellaneous cost code, promising to correct it later. To counteract this tendency, your accounting team should be trained to ask questions when job names or numbers are missing. Incomplete transactions shouldn’t be entered in the system until accurate cost codes can be identified.

3. Require purchase orders (POs). POs help make job costing for purchases of supplies and materials more effective. Each purchase should be assigned a unique PO number, and all materials and supplies should be tagged with PO numbers. This helps workers provide the proper coding information when these items are used on specific projects. An effective system helps ensure that no invoice will come to your office without a job name or number on it.

4. Be cautious when handing out company cards. With credit and debit cards, there’s usually no way to include a job name or number on the receipt. When submitting receipts to the office or completing expense reports, workers should be required to identify the project to which costs belong. It’s important to provide cards only to responsible workers who understand the importance of accurate job-costing information.

5. Clearly separate costs. If your company’s chart of accounts and job-cost ledger are set up professionally, cost allocations will become easier and more accurate. Job costs differ from office and overhead costs, so job costs should be assigned a job number that’s distinct from the general ledger account number.

For example, general ledger expense codes typically start with the 5,000 series of account numbers. Job costing becomes easier for everyone if general ledger costs are coded with 5,000 series numbers, while allocated job costs are coded with 6,000 series numbers, and office and overhead costs get 7,000 series account numbers.

6. Follow best practices. The job numbers you assign to projects should be carefully chosen following best practices. For example, a good job number isn’t just the next number in a haphazard sequence that starts with an arbitrary number and has three or four digits. Job numbers should convey such information as the year the project started, the activity involved, and whether the expenditure is for materials, equipment rental, labor or subcontractors.

We can help you set up a simple, but effective, job-costing system that conforms to industry best practices. This will make it easier for your staff to enter transactions into your accounting system. It’ll also help your management team identify which projects and customers are the most (and least) profitable — and take corrective actions to improve profitability down the road.

Data breaches can be costly. The average total cost of a data breach has risen to roughly $4.45 million, according to a 2023 survey of information technology (IT) security professionals by the Ponemon Institute (a research center dedicated to privacy, data protection, and information security policy). That figure has grown 15% overall in the last three years. Notably, data breach costs have increased 53% in the health care sector since 2020.

Auditors consider all kinds of risks when they prepare financial statements. Here’s how they specifically tackle the issue of IT security in an audit.

Audit scope

When it comes to evaluating cybersecurity risks, auditing standards require auditors to:

• Learn how businesses use IT and the impact of IT on the financial statements,
• Understand the extent of the companies’ automated controls as they relate to financial reporting, and
• Use their understanding of business IT systems and controls in assessing the risks of material misstatement of financial statements, including IT risks resulting from unauthorized access.

The auditor’s role is limited to the audit of the financial statements and, if applicable, the internal control over financial reporting (ICFR).

Primary focus

An auditor’s primary focus is on controls and systems that are in closest proximity to the application data of interest to the audit. This includes enterprise resource planning (ERP) systems, single-purpose applications (such as fixed asset systems), and any connected systems that house data related to the financial statements.

Companies must continuously update their controls and systems to stay atop the latest hacking techniques. Increasingly, companies are using artificial intelligence (AI) and automation to detect and contain breaches. According to the 2023 Ponemon Institute report, organizations that fully deploy cybersecurity AI and automation on average saw 108-day shorter breach lifecycles than organizations without these technologies in place. In addition, organizations that extensively use cybersecurity AI and automation to identify breaches experienced $1.76 million lower average loss than those without these technologies. In fact, these technologies were the biggest cost-savers identified in the report.

An auditor’s responsibilities don’t encompass an evaluation of cybersecurity risks across a company’s entire IT platform. But, if auditors learn of material breaches while performing audit procedures, they consider the impact on financial reporting (including disclosures) and ICFR.

Fortifying your defenses

Data breaches have become increasingly common and costly. It’s critical for business owners and managers to understand the scope of the external auditor’s responsibilities in this area and develop a cybersecurity program that mitigates the risks.