The practitioner should have an understanding of the relevant elements of internal compliance control, sufficient to plan the engagement and assess the risk of monitoring compliance with certain requirements. When planning the audit, this information should be used to identify potential types of non-compliance, to take into account factors that influence the risk of non-compliance, and to design appropriate compliance tests. Upon receipt of the IRS transcript, the lender must compare it to the financial statements submitted by the borrower prior to payment. In the event of a significant discrepancy, the lender must notify the SBA and not distribute the proceeds of the loan until the spread has been corrected. In this case, the lender may inform the applicant that the SBA has suspended the payment while considering an adverse change, but that the lender does not specifically refer to the IRS audit. SBA may deny responsibility for its guarantee to any lender who pays the product before receiving a response (or after receiving a response, but before a disparity is corrected). Our audit showed that the significant non-compliance with [the nature of the compliance requirement] for [the company name] ended [date] during the [period]. [Describe non-compliance.] The practitioner may be responsible for implementing agreed procedures to assist users in assessing the object (or related assertions) – the practitioner should (a) plan, execute and evaluate the results of his audit procedures and (b) the appropriate level of professional skepticism to obtain reasonable certainty about finding significant non-compliance, to exercise due diligence. The second type consists of offences committed after the notification of the reference period, but before the date of the practitioner`s report. The practitioner is not responsible for detecting such non-compliance.
However, if the practitioner is aware of such non-compliance, it may be of such a nature and importance that disclosure of these rules is necessary to prevent users from being misled. In such cases, the practitioner should include in his report an explanatory paragraph describing the nature of non-compliance. A report prepared in accordance with the provisions of this section does not contain any legal provisions regarding the compliance of certain requirements by a company. However, such a report can be helpful to a lawyer or others in decision-making. Another factor that the practitioner should consider when planning the engagement is whether the company has an internal audit function and the extent to which internal auditors are involved in monitoring compliance with the specified requirements.