This excerpt taken from the CRMT 10-K filed Jul 14, 2005.
Report of Independent Registered Public Accounting Firm
Stockholders and Board of Directors
Americas Car-Mart, Inc.
We have audited managements assessment, included in the accompanying Managements Report on Internal Controls Over Financial Reporting, that Americas Car-Mart, Inc. did not maintain effective internal control over financial reporting as of April 30, 2005, based on criteria established in Internal ControlIntegrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Americas Car-Mart, Inc.s management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on managements assessment, and an opinion on the effectiveness of the Companys internal control over financial reporting based on our audit.
We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, evaluating managements assessment, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.
A companys internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A companys internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the companys assets that could have a material effect on the financial statements.
Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
A material weakness is a control deficiency, or combination of control deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. We have identified the following material weakness that has also been identified as a material weakness in managements assessment. There are significant deficiencies related to (i) passwords (existence of blank passwords and default system passwords, lack of encryption, minimum length of passwords, lack of a system requirement to require periodic password changes), (ii) access controls and security (inadequate firewall and anti-virus software, lack of encryption of telnet use, periodic network vulnerability assessments, and access to sensitive data by unauthorized persons), (iii) change controls (inadequate documentation of program changes, formalizing user approval on program changes, documenting the evaluation of test results prior to implementing program changes, limiting access to source code to programmers), (iv) physical security (storing back-up tapes off-site, periodic equipment capacity monitoring), and (v) organization and management oversight (formalizing an IT strategic plan, developing an IT compliance function, adequate communication and implementation of IT policies and procedures). Taken together, these deficiencies rise to the level of a material weakness in internal controls over financial reporting. This material weakness did not result in any adjustment to the annual or interim financial statements, however; this material weakness could result in a material misstatement to future annual or interim financial statements that would not be prevented or detected. This material weakness was considered in determining the nature, timing, and extent of audit tests applied in our audit of the 2005 financial statements, and this report does not affect our report dated July 12, 2005, on those financial statements.
In our opinion, managements assessment that Americas Car-Mart, Inc. did not maintain effective internal control over financial reporting as of April 30, 2005, is fairly stated, in all material respects, based on criteria established in Internal ControlIntegrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Also in our opinion, because of the effect of the material weakness described above on the achievement of the objectives of the control criteria, Americas Car-Mart, Inc., has not maintained effective internal control over financial reporting as of April 30, 2005, based on criteria established in Internal ControlIntegrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Americas Car-Mart, Inc. (a Texas corporation), as of April 30, 2005 and 2004, and the related consolidated statements of operations, stockholders equity, and cash flows for each of the three years in the period ended April 30, 2005, and our report dated July 12, 2005 contained elsewhere herein, expressed an unqualified opinion thereon.