Do Funders Have the Right to See a Nonprofit’s Management Letter?
By Candice Meth, CPA, Partner in the Not-for-Profit Services Group of EisnerAmper LLP
At my session for Philanthropy New York, entitled “What to Look for in a Nonprofit’s Financial Statement,” more than half of the attendees said they ask to see a nonprofit’s management letter as part of their standard grant approval process.
The language found in the letter issued by auditors and presented to their client, referred to by the accounting profession as the “letter to those charged with governance,” but more commonly referred to by the public as the “management letter” looks like the following:
This written communication is intended solely for the information and use of the Organization's Board of Directors and management and is not intended to be used, and should not be used, by anyone other than these specified parties.
It is by definition a “limited-use” report according to the standards established by the American Institute of Certified Public Accountants (the “AICPA”). Yet many funders request it as part of their grant application process, and the question of whether they really understand the limits of what they are looking at is increasingly important.
The management letter is part of the result of the audit process and is given to management and “those charged with governance” (the governing board). The auditor is required to disclose whether any “material weaknesses” in internal controls were identified during the audit process. The lack of material weaknesses might provide comfort to potential donors; however, there are other types of internal control issues that are not required to be communicated to those charged with governance, but still indicate that improvements are needed within the organization’s control structure.
How would a potential donor know that?
In addition, there is a limitation on identifying even material weaknesses. A financial statement audit is not designed to, and does not provide assurance about the internal control structure itself. Therefore while the management letter may include comments about internal controls, the letter should not be misinterpreted as an opinion on the entire internal control structure of the organization. This distinction can be unclear to funders who obtain the letter to seek assurance that the internal controls of the organization are sound. Additionally, the letter reflects the internal controls functioning at the time of the audit. If management has since remedied identified issues, the correction of the issues might not appear until the following year’s audit process. Likewise, a breakdown in controls after the year-end audit would not be reflected either.
Private foundation funders are not the only organizations asking to see this letter. The New York State Attorney General’s Charity Bureau requests the management letter when investigating an organization. New Jersey requires the management letter be attached to its Long-Form Renewal Registration/Verification Statement annual compliance filing. It appears that State regulators and donors believe the letter influences their ability to evaluate an organization. Is too much prominence being given to the letter without proper education of its value? Perhaps.
This is certainly not a clear-cut area. There appears to be a rise in the number of outside parties requesting the letter, and concurrently the accounting profession continues to stress the reasons why the letter is not suitable for unintended users. Does the letter provide value and assurance if its origin and purpose are perhaps misunderstood? The debate will certainly carry on, even if a solution is not on the horizon.