SAS No. 115 places significant responsibilities on the auditors of nonpublic companies to communicate internal control deficiencies identified in an audit. SAS No. 115, combined with the requirements in the recently effective Risk Assessment Standards, will likely increase the quantity and variety of control deficiencies required to be communicated to management and those charged with governance – not just in the initial year of discovery, but in each subsequent year until the deficiency is remediated. Are you ready?