Hi – I am going to paste a section of my notes…I believe it answers your question. Basically, if the auditors discover an internal control defficiency, it does not mean that the FS are misstated…so yes, you can have different opinions.
Internal Control Communications:
*When evaluating whether a control deficiency is a significant deficiency or a material weakness, consider both the likelihood and magnitude of any potential misstatement
*All material weaknesses are significant deficiencies, but not all significant deficiencies are material weaknesses
-Material weaknesses are considered to have a reasonable Likelihood and a material Magnitude
*Significant deficiencies in design or operation of I/C are important enough to merit attention by those charged w/governance
*Engagements to report on a corrected previously identified I/C deficiency are voluntary! But management would have to provide a written report to go w/ the audit report
*In response to discovering a deviation from prescribed I/C procedures, make inquires to understand the potential consequence of the deviation
*Internal Control for Issuer audits
-BOTH management & the auditor must assesses and report on internal control
-PCAOB require integrated audits! If you audit the FS you must also audit the I/C
-You HAVE to provide an opinion on the FS AND on the effectiveness of Internal control! (can be either a separate or combined report)
*You are REQUIRED to Communicate all deficiencies in I/C to management, and significant/material weaknesses to management AND the audit committee, BUT only Material weaknesses result in a Adverse opinion on the effectiveness of I/C
*A Scope limit requires you to Disclaim the opinion and a material weakness requires you to DISCLAIM!
*Internal Control for Nonissuer audits -Meant to only audit F/S & Not the I/C:
-Not obligated to check I/C!
-You may expand the scope paragraph of the report to say that I/C testing level is not the same as is required for audits of issuers under the SOX act.
-You are obligated to communicate both significant deficiencies and material weaknesses to mgmt and those charged with governance
-If you found something that is significant/material. Any report issued on such conditions should 1) Say that the purpose of the audit was to report on FS and not on I/C; 2) define material weakness and significant deficiency; 3) restrict the report—> You may choose to communicate significant deficiencies during the audit rather than after the audit (it is your choice)
-A previously communicated significant deficiency that has not been corrected should be communicated again in writing during the current audit
*Internal Control for Nonissuer engagement -Meant to report on I/C (Attest engagement):
-In order to accept the engagement =Management must present its written assertion about the effectiveness of I/C
-Report should include a paragraph stating that Inherent limitations exist in any internal control so they may not prevent, or detect and correct misstatements
.