Control Deficiencies in Lease Accounting: Common Findings

Understand Lease Accounting Control Weaknesses & Fixes

Lease control deficiencies are a major worry for controllers, accounting managers, and auditors. That is most true now that ASC 842 is in force. Weak internal controls can lead to material misstatements. They can also lead to more audit scrutiny and possible non-compliance with accounting standards.

The completeness assertion refers to an auditor's objective to verify that all transactions and accounts that should be recorded have been included in the financial statements. For lease accounting, this means making sure every lease agreement is properly identified and recorded. That holds for explicit leases and embedded ones alike.

When a company does not manage these controls well, the result can be large financial reporting risks. Those risks bear directly on how accurate the financial statements are and on how the audit turns out.

This article covers common control deficiencies in lease accounting and their effect on ASC 842 controls. It shows how companies can tighten their processes to reach lease accounting compliance. It also covers what auditors look for. And it shows how accounting teams can test their own approach to proving the lease population is complete.

For a complete breakdown, see our ASC 842 guide.

How Auditors Identify a Lease Control Deficiency

Auditors look closely at how a company accounts for its leases. They focus on the design and operating effectiveness of internal controls. Their goal is to gain reasonable assurance that the financial statements present lease liabilities and right-of-use (ROU) assets accurately.

To get there, they run substantive tests of balances. They also evaluate in depth the controls that prevent or detect material misstatements.

Which auditing standards apply depends on the company. Audits of public companies and other issuers follow PCAOB standards; audits of private companies follow the AICPA's Statements on Auditing Standards, which apply to reports for nonissuers¹. Under either framework the auditor has to understand the entity's system of internal control and assess the risks of material misstatement. That assessment drives how much substantive work the lease balances need.

✅ Best Practice: Strong lease controls procedures should span the whole lease lifecycle. That runs from identification and abstraction to remeasurement and financial reporting.

Auditors take a risk-based approach. They often start by getting to know the overall control environment. Then they drill down into the specific areas prone to error. A main focus is the completeness of the lease population.

Q: How do auditors test for lease accounting control deficiencies?
A: Auditors often perform roll-forwards from prior periods and review contract populations. They often comb expense accounts for lease-like payments too, and they interview staff to learn how leases get identified. They will also look for proof that the company consistently reviews contracts for embedded leases, a common source of deficiencies.

What are the risks of incomplete lease population? An incomplete lease population understates lease liabilities and ROU assets, and skews the ratios that run off them. Whether the understatement rises to a material misstatement depends on the size of the omission against the entity's own materiality. That is why the audit question is always the aggregate of what was missed, not any one contract.

Auditor Focus Areas in Lease Accounting Controls

A single system of record and clear ownership of lease data are what make completeness and accuracy testable; scattered spreadsheets make both a matter of assertion. Auditors want proof that management has set policies and procedures to identify new leases, modifications, and terminations. That includes a review of how leases get abstracted. It also includes the reconciliations between the lease accounting system and the general ledger.

Where Lease Controls Most Often Break Down

ASC 842 was hard to put in place, and many companies still struggle to set up effective controls. A right-of-use (ROU) asset is "an asset that represents a lessee's right to use an underlying asset for the lease term" (ASC 842 Glossary). Deficiencies in controls over these assets and the liabilities that go with them bring several key risks:

• Incomplete Lease Population: The company fails to identify all of its lease agreements. That includes those that are verbal or embedded within service contracts. This is a common source of lease control deficiencies.
• Inaccurate Data Abstraction: Staff make errors when they abstract critical lease terms from contracts (e.g., lease term, payment amounts, discount rates). Those errors lead to wrong calculations of ROU assets and lease liabilities.
• Improper Lease Classification: A finance lease gets classified as an operating lease, or vice-versa. That affects financial ratios and debt covenants.
• Lack of Segregation of Duties: Lease contract negotiation, data input into the lease system, and general ledger posting are not kept separate enough. That raises the risk of fraud or error.
• Failure to Account for Lease Modifications: The company does not properly recognize lease modifications on time and with accuracy. These include extensions, contractions, and full or partial terminations. A negotiated change to the scope of or the consideration for a lease is a lease modification (ASC 842 Glossary). When it is not a separate contract, the lessee reallocates the consideration and remeasures the liability (ASC 842-10-25-11).
• Inadequate Review and Reconciliation: There are no periodic reviews of lease data against source documents. And no one reconciles the lease sub-ledger to the general ledger.

⚠️ Risk Alert: A common audit finding is that companies never check service contracts for embedded leases. An unidentified embedded lease understates lease obligations, and a process that never looks cannot tell you by how much.

Scenario Example: Unidentified Embedded Leases

A manufacturing company signs a service contract for third-party logistics (3PL) to manage its warehouse and distribution. The contract says the 3PL provider must use one particular warehouse for a fixed term of five years. That warehouse is dedicated to the manufacturing company's products.

The contract also has to name an asset the 3PL cannot swap out at will. If the provider can move the goods to another warehouse and would benefit from doing so, there is no identified asset and no lease (ASC 842-10-15-10).

The warehouse is dedicated to this customer's products for the whole five years, so the manufacturer obtains substantially all of the economic benefits from using it. It also directs how the space is used — product placement, shipping schedules. Both limbs of ASC 842-10-15-4 are met, so the arrangement contains an embedded lease.

Suppose the company's internal controls do not include a systematic review of service contracts for such terms. Then this embedded lease will likely go unidentified. That leads to an understatement of the ROU asset and lease liability on the balance sheet.

Practical Checklist for Effective Lease Accounting Controls

A structured approach to lease accounting controls is crucial for compliance and for being ready for audit. This checklist helps make sure the key areas get covered. An embedded lease refers to a lease component contained within a larger contract that may not be explicitly identified as a lease. ASC 842-10-15-2 requires an entity to determine at inception whether a contract is or contains a lease, so finding these is a critical control.

Lease Accounting Control Checklist

💡 Key Takeaway: Applying standardized procedures the same way each time is key to reducing lease control deficiencies.

This checklist lines up with our ASC 842 internal control framework and stresses proactive management. How to identify embedded leases in contracts? Start by training procurement and legal teams to spot "right-to-use" wording inside broader service agreements.

Set up a formal review process for all significant contracts, not just the ones plainly labeled as leases. Consider using AI-powered contract analysis tools to flag possible embedded leases.

How to Test Your Lease Controls Are Operating

Effective validation makes sure the controls in place operate as intended. Accounting teams are responsible for designing these controls. They are also responsible for monitoring how well the controls work. This often means self-assessment and periodic testing.

Management can borrow the auditor's own framework for this. AU-C section 315, as amended by SAS No. 145, sets out how an auditor obtains an understanding of the entity's system of internal control. The same standard covers identifying the risks of material misstatement, which is the lens to apply to a company's own lease process. AICPA & CIMA describe the requirement in Applying and Scaling Audit Risk Assessment Procedures Under SAS No. 145.

1. Documentation Review: Start by reviewing all policies, procedures, and training materials for lease accounting. Make sure they are up to date and match current processes. Check that all key decisions are documented with clear reasons, most of all those on classification and modification accounting.

For full guidance on required documentation, see our article on lease management documentation compliance.

2. Walkthroughs: Conduct walkthroughs of the key lease accounting processes, from identification to financial reporting. That means tracing a few transactions through the whole process, interviewing staff, and observing control activities.

For instance, trace a new lease contract from its first receipt by the procurement team through abstraction, entry into the lease software, and at last to the general ledger.

3. Independent Re-performance: For critical controls, such as lease abstraction or classification, consider having an independent member of the accounting team re-perform the control to ensure consistency and accuracy. Re-performance uncovers differences that a single reviewer would miss.

4. Data Analytics: Use data analytics tools to find anomalies. For example, analyze general ledger accounts for recurring payments that might point to unrecorded leases. Compare recorded lease terms with payment schedules to detect possible errors.

🚨 Critical: A company that skips regular internal validation can face significant audit findings. It can also face costly re-work during external audits.

Q: How can I prevent control deficiencies in ASC 842? A: To prevent control deficiencies, combine strong policy, trained staff, the right technology, and continuous monitoring. Review your control framework on a regular basis, and train staff on the fine points of ASC 842. Use lease accounting software to automate calculations and reporting.

Common Control Gaps and How to Close Them

Even with strong systems, certain pitfalls often lead to lease control deficiencies. Knowing them can help companies strengthen their internal environment before problems arise. What documentation do auditors expect to see for lease control deficiencies? It is crucial to document in full all controls, testing procedures, identified deficiencies, and remediation plans.

Pitfalls and Best Practices in Lease Accounting Controls

💡 Tip: Two control areas deserve the most attention: abstracting lease terms from the contract, and catching the events that require the lessee to remeasure the lease payments after commencement (ASC 842-10-35-4; the lessee remeasures the liability under ASC 842-20-35-4).

Calculation Example: Impact of an Unrecorded Lease

Scenario: A company fails to record a 5-year operating lease. Rent is $20,000 a year, payable at each year-end (in arrears), and the company's incremental borrowing rate is 5%. The figures below are the commencement-date balances; a lease discovered later is understated by the carrying amounts at the date it is found.

Key Takeaway: An unrecorded lease understates both assets and liabilities. Aggregate enough of them and the balance sheet is misstated. A lessee that has set a capitalization threshold still has to judge the combined effect, including the effect on the ASC 842 disclosures (ASC 842-20-50). KPMG's Handbook: Leases covers how to set one in §6.3.

What an Effective Lease Control Looks Like

Companies with effective controls in lease accounting share several traits. Those traits lead to cleaner audits and more reliable financial reporting. They include a clear grasp of ASC 842 disclosure requirements.

✅ Best Practice: Companies that achieve strong lease accounting compliance often lean on technology, keep a culture of careful documentation, and get departments to work together.

A well-run lease accounting process has these features:

1. Centralized, Automated System: The company manages all lease agreements in dedicated lease accounting software. That gives it a single source of truth and automated calculations. This often leads to smoother SOC 1 lease accounting software audits.
2. Cross-Functional Team: A team with people from finance, legal, procurement, and operations meets regularly. It identifies new leases, reviews contracts, and discusses modifications.
3. Proactive Identification: A process flags new contracts for lease assessment before they are signed. That cuts the risk of unrecorded leases to a minimum.
4. Robust Documentation: The team documents every decision, assumption, and calculation clearly and keeps it on hand for review.
5. Regular Reconciliation: The team reconciles lease sub-ledgers to the general ledger monthly. It looks into variances promptly and resolves them. This process helps address "what are typical audit findings related to lease accounting controls?"

For example, a multinational corporation with strong execution might use a global lease management system. The system picks up changes in lease terms from contract amendments on its own. It feeds them into the accounting engine. It then creates the needed journal entries and disclosures.

The corporation's audit trails are complete. They show who abstracted each lease, who reviewed it, and when entries were posted. This proactive, systematic approach keeps lease control deficiencies to a minimum.

Where to Go From Here on Control Deficiencies

Dealing with lease control deficiencies takes steady effort and commitment. Companies should reassess their internal controls on a regular basis. That matters most as the lease portfolio changes or as accounting standards are updated. Proactive internal reviews and good use of technology are key to staying compliant and to a smoother audit process.

Related Articles

• Implementing Top 10 Lease Accounting Internal Controls
• Auditing ASC 842 Lease Accounting: An Auditor's Guide
• Top 10 Year-End Lease Accounting Challenges
• How to Achieve Lease Accounting Compliance